hmm... the footprint for adding winscp should be pretty small.  I don't know why they would need putty on there just to transfer files(although that should also be a very small footprint).  As far as security impact, your SQL Server is hopefully behind a firewall and it would be up to whoever manages that to set it up to allow access to wherever you're pushing the files to and if you're only pushing out files there would be no need open any ports up for incoming connections.

That said depending on your organization if you have some kind of dedicated file transfer process it might be easier to just write out whatever files and let that process take over without using SSIS to transfer anything.