Client can install APS plugins to other websites
When we get a new web hosting client, we also setup the client with access to manage his own website.
When these clients attempt to login to manage their website and install APS plugins such as WordPress, it prompts them for which website they wish to install the WordPress plugin for. At this point, it gives the user the ability to install plugins for websites that do not belong to them.
I have confirmed that when the client logs in with their own credentials, they are only able to manage their own web domain. The exception to this rule would be the APS installer which allows them to install plugins for a website other than theirs.