[semi-extrinsic]

OTOH, if you run vanilla ssh on a publicly accessible machine where only port 22 is open, sshd only allows publickey-based authentication and the only accepted key types are FIDO2/U2F hardware-backed keys, it's probably more secure again (less attack surface).

[angry_octet]

Unless you're using short lived SSH CA certificates, SSH key access has only modest security. You would need to buttress it with TOTP 2FA or enforce Yubikey generation/storage of keys, neither of which are at all default.

Even then, it's obvious you are running SSH, and they can fingerprint the OS, and external logging shows which machines are connecting, and hence have said SSH keys. If they have SSH open they become targets; if they come from CGNAT, carriers can leak location via CGNAT behaviour.

In contrast tailscale makes this much harder.