I don't know about the FrontPage extensions. I would err on the side of caution and remove them.
But the cgi programs are under your control, and you should be able to secure the cgi-bin or cgi-local directory to prevent someone from uploading a trojan'ed program, or a new program. See if the permissions on your program directory are set to something like 755, which gives you read/write/execute, and everyone else only has read/execute.
Of course, you should realize that ftp sends passwords in the clear, so if someone could have a packet sniffer on the line, you'll want to find another way to update your site.
Chip H.