[dx034]

Theoretically, a vulnerability in SSH could expose you, but I think those are quite rare. The bigger risk of keeping the server exposed is probably that some application opens another port. But that won't happen on Port 22, so that one could stay open to all.

[gregjor]

I think ssh has been scrutinized by hackers already. Vulnerabilities I know about have to do with servers using deprecated encryption algorithms.

Firewall rules in front of ssh are a good idea but I don’t think that adds security to ssh itself. It does block apps opening ports, as you point out.