I think that if you follow the recommendation to disable password-based authentication, then fail2ban is downgraded from a near-requirement to a defense-in-dept

I think that if you follow the recommendation to disable password-based authentication, then fail2ban is downgraded from a near-requirement to a defense-in-depth tactic. It's not nearly as important to restrict the number of retries if asymmetric key-based authentication is used, because there is a much larger keyspace to search through than if passwords were used - assuming that the cryptography works as intended.