[hn_throwaway_69]

As you essentially say, WireGuard is great. I firewall off direct SSH and first use WireGuard to connect to the server instead.

One advantage is that if your firewall is setup right it's completely invisible, as unauthenticated UDP packets are dropped, as is the case with any other, unused, UDP port.

I still configure SSH to best practices just in case a configuration blunder inadvertently causes the firewall to accept connections.