changing media.php and comment.php inside wp-includes

I hired an Odesk developer to add some functionality to my theme/plugin. Today he sent me an email telling me which files he modified in my test site I have him working on to achieve the new functionality. Aside from several theme and plugin files inside wp-content, he also changed media.php and comment.php inside wp-includes. It is my understanding that this bad practice (hacking core= changes get wiped out when I update WP, security issues, conflicts with other plugins, etc.)

Is my above understanding correct?

Are there any instances where it would be ok to change these wp-includes files (e.g.: if its the comment.php, no big deal, little risk, etc.)

Should I not trust this developer too much? (should I assume he is cutting corners thinking I won't notice because I'm a newbie)

I have almost zero coding knowledge and don't want to give him bad instructions or tell him not to hack core when in this instance it might be ok??