Dont allow full access unless you have to, if need be get them to develop it on a second server and have someone transfer it all to your main one when its completed.
If they do have access to main server, delete their logins after completion, and change any passwords if they used one you cant delete.
I personally would recommend having the whole of the code professionally checked, to ensure they have not put in any back-doors, also to ensure its
secure.
There could be a reason the code is cheap, and it may not be down to low wages in that country, it could be lack of experience - its not that hard for people to set up shop as a developer these days, especially if they use existing code from elsewhere - but only a lot of experience and good skills will ensure you are safe in the long run, not just from a security/safety standpoint, but performance issues, scaleability and maintance issues, not to mention support..
Also, if you are paying for someone to update or add to a existing site, dont allow them access to your data!
If you let them loose on your real data, they would have full access to all your customer records, financial info, address details, credit cards etc - maybe even suppliers details etc. Always supply them with a demo set of data in a secondary identical copy (structure wise) of your main database, never the real data.....