There are quite a few arguments: * attacker can't do successfull bruteforce attemps at the same rate or at all * attacker can't reliable intercept (MITM) traf

There are quite a few arguments: * attacker can't do successfull bruteforce attemps at the same rate or at all * attacker can't reliable intercept (MITM) traffic, as he does not what port is being used * attacker can' launch sshd DoS attacks, as he does not know where does sshd listen at (at least he has to try 65000 x bigger space, this precludes a lot of time based attacks