I am not sure it reduces security. You have a valid point. I adds an attack vector. However "only" if you have the attacker in your system already. Having all

I am not sure it reduces security. You have a valid point. I adds an attack vector. However "only" if you have the attacker in your system already. Having all the log spam from failed attempts on 22 might the make the admin negligent on carefully following their logs at all. Having it pretty silent on a higher port usually will make you notice occasional scanning. At least I have noticed it and made me tighten the firewall a bit. There is no perfect security.