I guess I'm also worried about an SSH zero day hitting that I could avoid if I firewall filter the source IPs. I offer other services on the public internet so

I guess I'm also worried about an SSH zero day hitting that I could avoid if I firewall filter the source IPs. I offer other services on the public internet so a zero day could hit them but I don't have a choice in those cases (eg. incoming mail on 25), however with SSH I don't need to offer it to the world so why take the risk in the first place?