As others noted, probably because once you disable password authentication you're cutting out the ability for most bruteforce attempts to work. However, I stil

As others noted, probably because once you disable password authentication you're cutting out the ability for most bruteforce attempts to work. However, I still think it's valuable for the following reasons: 1) It can slow stupid attackers down, e.g.: those that don't abort a bruteforce attempt when they see password authentication is disabled. Judging by my logs there's lots of those still out there. 2) It keeps the SSH logs less cluttered. 3) You can use it to build a set of hosts to consider blocking permanently.