There have been security problems with VMWare,KVM and XEN in the past, where you could get root on the VM-server if you were root in the VM.
For this reason I understand the unwillingness to pass root-passwords even for VMs.
An example for XEN is CVE-2012-3515 (this looks harmless on the third glance).
An example for KVM is CVE-2011-2512.
An example for VMWare is CVE-2012-1518.
As there may be other unknown zero-day-exploits around one can never be sure...
root-access in XEN will give you control about xen-ram-ballooning, too. This might have some bad side-effects on the VM-server-side, too (I tested this on a XEN Dom0: there are cases where the Dom0 does not tell the admin the truth any longer about the memory-consumtion of the DomU).