[guenthert]

There are those who run sshd on a non-standard port and log all attempts to connect to the standard port though.

[Hackbraten]

Those connection attempts wouldn't ever reach the daemon though, let alone get to preauth. So how would an exploitation attempt even be distinguishable from, say, a harmless random password guess if neither ever gets to see the daemon?