User Profiles are stored in the MixRack and are independent of Show files. You might want the operator to recall different Show files, but prevent them from updating firmware or changing network settings. Show management is itself a permission option of user profiles. So they have to be separate.
There is no mechanism at present for backing up User Profiles.
Custom controls – do you mean the Layouts (interfaces) for the Custom Control app? If so, that’s also expected. The Custom Control config is stored in the MixRack as a separate .xml file and can be backed up via the Custom Control editor. Again, this was designed for flexibility so that system integrators could allow multiple Show files to be used on a system, but with a common Custom Control interface – think iPod behind the bar counter type of thing.