Any developer worth dealing with is going to provide the first two, and NEVER do that third one; that said there are a LOT of sleazeball scam artists who want to take advantage of people who don't know any better, locking you into their and only their services by not providing source or server access. That's just scummy practice and anyone doing it should be ashamed of themselves.
It's the client's site; as such they should be given full access so they can switch who's working on it if need be. That means domain control, ownership of the hosting, FTP access, the works... Not just for if they decide to switch who works on it, but should they HAVE to switch due to illness, infirmity -- you don't know what the future holds.
