I have concerns about the exploitability of an experimental service in this space. I wonder if there is a way to test this (and attack it) a few ways without giving wide access to it initially. Like maybe firewall the VM to only allow connections from another project VM initially.

Isn't the use of ssh one of the inessential complexities that PAWS was meant to remove from Toolforge? What is the real benefit of being able to ssh into docker container for a PAWS user?

This feature would blur the line between Toolforge and PAWS, thus confusing when we should suggest that someone move from PAWS to Toolforge. Something that I am typically reticent to do. As mentioned by @bd808 a user who is seeking an ssh connection to do work is likely better suited by Toolforge, and is best assisted by being directed to Toolforge.