Almost always they will never get access to the cpanel, because they won't know the url to it. Also people shouldn't use the same name/password combination for both, at least I've never worked for anyone who hasn't and I don't. About the book, I wouldn't rely on one source for a single thing, try reading several blogs on this subject.