Your points are quite valid.
I admit to being out of the admin and security side of servers for a few years now, however
there was too many security concerns and holes in so many various FTP programs that
a secure version was simply necessary... and I prefer to not use anything else even today.
That said, for the small number of users I need to satisfy, I believe I will setup Pro-ftpd or
Pure-ftpd with FXP enabled but restrict the valid IP addresses that can access the server.
I will attempt to still get it working within the chroot'ed jail that I have setup now for sftp users.
Paranoia takes less time to deal with than fixing hack attacks or actual break-in
