Don't recall ever doing it for a router, but I have, on couple of occasions, loaded an IOS image on 3750 switches via the console port and using XModem.
Even when you set the console port to its maximum speed, it takes a while, often a long while, to load a typical IOS sized image (which, generally, continue to increase in size with newer releases).
You may also find, the Cisco device won't support the "best" performing data file transfer protocols.
The load time is so long, I would often try to find the "smallest" IOS image I could find so that I could boot the 3750 into it and use something like TFTP to load the IOS I really wanted to use.
I would suggest it would be better to have a discussion, about security, with your client. In my experience, many don't truly understand computer security and either are too lax or too stringent. Possibly your client is in the latter group.
BTW, a couple of security "stories" I like to tell. Years ago, in one large corporate (Windows) network, they insured there was no account named "administrator". This because, it made it more "difficult" to attack such a key account.
So, one day, I sent the DC chief a list of all the user accounts that had "administrator" privilege (NB: which I did not have myself). After getting over his shock, he asked how I obtained this list. I said, easy, I just wrote a small program, making a LANMAN call, asking for all the user accounts in the "administrator" group.
Or, at the same company, I remember when they activated the feature that all passwords had to have both upper and lower case. I said, you do know that if, when logging onto the network, you declare yourself a down level client, i.e. prior to Windows NT, the logon process will ignore letter case? Of course, you can enable a feature disallowing down level clients, but then all your Windows clients, not yet Windows NT (at the time about 99.9%) won't be able to log on.
The point of these two stories isn't that what was done was bad, only that the changes didn't really add as much additional security as many thought they did.
Likewise, possibly, your client's desire to avoid on-net file transfers and/or local USB file transfers, might be based on not using them makes their devices much more secure and/or using them cannot be done without making the devices much less secure.
