I always add the client to the profile, but I don't think they've ever logged in. And I'd prefer to do it the proper way (aka add the SEO company as a user) than let my client share their login details around.