I briefly worked for Barracuda support a few years ago. I don't know how they market or publicly document the boxes, but it seemed common knowledge that we had ssh access. None of the customers I talked to blinked an eye. Most of them outright expected it. So I'm not sure it's so much "backdoor" as "feature".