There is some undeniable cleverness of the malware itself, but it is ever so frustrating that the "ssh in with a weak/known username/password" is still a thing

There is some undeniable cleverness of the malware itself, but it is ever so frustrating that the "ssh in with a weak/known username/password" is still a thing in 2022. Fail2ban + ssh keys isn't that onerous, is it? Granted, there is the law of large numbers at play here, but damn if this sort of problem being a thing isn't, at the risk of appearing needlessly judgemental, an utterly preventable footgun.