That works both ways though. Imagine in your scenario you have thousands of servers across a large organization, many that may be running on auto-pilot and don'

That works both ways though. Imagine in your scenario you have thousands of servers across a large organization, many that may be running on auto-pilot and don't have any active team maintaining them. When the hypothesizes critical OpenSSL bug pops up, the first thing you will want to do is find out all the server in your network running sshd so you can patch them. If they are all listening on some random port then that task becomes much, much harder.