You don't trust him with ssh access to your server, yet you trust him to run arbitrary code there. That doesn't make any sense.
When people say "ssh access" they usually mean root. The software that's running there, if the server is properly set up, will be running on a restricted account with restricted privileges. Now, granted, even with that there can be quite a bit of damage, but not as much as giving somebody root access to your system.
I think that the proper solution to any paid, self hosted application would be ... to provide hosting for less tech savvy users. Granted, your main selling point is to be self hosted, but you should not alienate people who are interested just by the product itself. And having a less costy per month plan is a great mean to let users try your app before deciding they should takes time or money to educate or hire a sysadmin.
My point is more that it's probably a good thing to provide both webservice and installable app (github, with its github enterprise is a very good example of that, even if way too expansive), to let user choose your product based on what it does instead of what are its requirements and implications.
And b) assuming you have done your due diligence on the developer in the first place, why not trust him with access to your machine? And again - you shouldn't grant him root of course, but a shell account with privileges similar to the application would be fine.
But really - Purchasing a script from some back-alley developer you have no knowledge of and placing it on your production server? That's the reckless part.