It is very bad practise indeed and I am fine, if you want to quote me on this to argue with the client.
I know some orgs are very concerned about consultants seeing live payroll data, but if they want decent quality support, the very least they need to do is to provide a QS system, where the error can be reproduced. There are many tools on the market to copy test cases from prod to test, while scrambling names etc, so individuals can't be recognised. Giving support consultants that access will save them a lot of time and money. After all: SAP isn't providing an interactive log on payroll, because they were bored, but because they know it's a crucial tool.
All the best
Sven