Masbro,
We run into this issue all the time working with small business owners. They have a friend's cousin's nephew from down the street get them a website and don't tell them anything about what really is going on with their domain purchase/renewals, where they bought the domain, where they bought the hosting, the login for hosting, where they are hosting email, or logins to WordPress/Drupal/etc if using a CMS. The list goes on.
Unfortunately for us, we have to figure all of that out for them. Although, fortunately, we also get to build a great rapport with the client and educate them on making sure they maintain control over all of their property. I would educate them about all you know for consolidating their domain, hosting and email if you wanted and make sure you keep a login record and you share that with them as well. If they lose it, then you have it.
Now, to answer your question. Many folks are very hesitant to provide direct cPanel access because they may be in a shared environment with many other domains and websites being hosted. So, once they give you login, then you may be able to see ALL of their clients or websites and, to me, that is a big security vulnerability. I'd never allow just anyone into our shared server.
They may also just want to validate who you are in representing your mutual client on their behalf. Usually a phone call to them, with the client on the line is a good starting point, or an email from the client to the host provider.
It really all depends on the level of work you have to do. If it's minor, then you can ask them to provide FTP or SFTP login OR if it's something major or a brand new website, then another alternative you could request is for them to simply provide you a full backup of the website/database files (if any) and you can move the hosting to another provider where you have a little more control.
I believe they are simply looking at this from a security viewpoint. Allowing you access, wouldn't be beneficial to their other clients in the server, putting them at risk potentially.
Again, there are several ways to get to the end point based on your goals and needs for the client. We see it all the time and sometimes it goes smoothly, and others, it can be a long-drawn out nightmare. I hope it's not that latter for you And I hope this was a helpful answer!