Django - Should I set show_toolbar in production for management users?

There are a couple of reasons why this is still risky:

1. You're making a lot of configuration information visible to users. If one of those admin accounts gets compromised then an attacker would have access to a lot of very useful low-level information about your server configuration.

2. Debug toolbar uses AJAX views to serve the debug information. While these views do check permissions, using them in production opens up another vector of attack, where someone could manipulate the client-side code for a management user to perform AJAX requests in the background to fetch data from these URLs, without the user knowing about it.

Both of these risks require other things to go wrong - it's a question of how much you value defence in depth.