Hi ,
ABAPers are provided "debug" option in Production , there is no harm in that. As you don't replicate the P to Q on daily basis,so in crictical scenarios they need "Debug" authorizaion. but double ensure the following:
1) Create & change activity is not assigned in S_DEVELOP object.
2) Also without SSCR key , ABAPer can neither create or change any object , so its always recomended that user id should be different in Dev and Prod .
3) Production is Close Client and Global namespace settings are Non-Modifiable , so they won't be able to change any object.
Regards,
Deepak