FTP Functions

I was wondering what security risks there are when using FTP functions. I created a browser-based management site for my clients so they may write and upload files to the server. I had to use FTP functions because there was some problem with file owner/permission being set to 'nobody'. Supposedly you would normally use a suexec wrapper but it failed (atleast with PHP v.3) because PHP was called after it or something. My current isp has enabled FTP functions which has worked great, but I'm thinking of switching isp. I talked to an isp today that said FTP functions are a major security risk and can easily be hacked. Arghh! I wondered if this were true, since the function uses a username and password like you would with any FTP application. Does anyone have comments or suggestions? Thanks! - Michelle :)