Hi Greg,
Permission to activate plugin does not give to a user a permission to use it.
If ‘activate/deactivate’ plugin is not critical function for your shop manager (you may activate those plugins once as administrator) you may do not give him ‘activate_plugins’ capability at all.
WitFTP protectes its menu item by ‘manage_options’ user capability.
You may use ‘Admin menu access’ add-on
https://www.role-editor.com/block-admin-menu-items
in order to block extra menu items which will become available to editor tole after you add to it the ‘manage_options’ capability.
It seems that shop manager has enough permissions to access BackupBuddy. I don’t have it on hands to check what capabilities it requires. I may check that if you send plugin copy to support email. I use such plugins for testing purpose and locally only.
