When I asked them about this and why they do not even tell the customer about this, they said it is so that they can reset the password when requested through the control panel.
See virt-rescue(1) (and libguestfs-tools in general) for how to do it properly.
That's totally not equivalent to the use of "setenforce 0".
Then you write that SELinux doesn't reduce the risk. It definitely does that for webapps executing wrong commands, utility services being exploited for local access, many attempts at race conditions via shared directories, etc. For example almost all interesting use cases for imagetragick exploits are severely limited by properly configured selinux. Once in a while there's going to be an issue with a trivial exploit which everybody and their dog will use to scan the whole internet before you have time to patch. This is what LSM is great to protect against.
I saw no 0-day exploits to date which are stopped by SELinux. For example, a trojan can use apache process as malware host, without reading/writing to disk at all. SELinux will not stop that even in theory.
For most of automated exploitation, selinux is perfectly capable of intervening.
I think that is a reasonable sacrifice considering you lost access to your system.