Yes, either that or a dedicated sudo-enabled account. It's a slight step up from the older setups where they had a dedicated account with a common password known to all the second-level and higher techs.

It's because 90% of users don't know what they're doing and at some point will ask for support, and they probably won't be able to get the techs access when needed. It sucks for the 10% who are capable and willing to operate their servers independently.

Source: I've worked at hosting companies.

The reality is that they own your hardware and can do whatever they want. But most hosts are more subtle about this.