If there’s a preauth RCE in ssh, I’m sure threat actors will start scanning non default ports once their hornets have hit critical mass.