Until there is a new zero day on sshd. You want to keep these things behind multiple locked doors, not just one. For the servers themselves, you shouldn't be

Until there is a new zero day on sshd. You want to keep these things behind multiple locked doors, not just one. For the servers themselves, you shouldn't be able to get to sshd unless you're coming from one of the approved bastion servers. You shouldn't be able to get to one of the approved bastion servers unless you're coming from one of the approved trusted sources, on the approved user access list, and using your short-lived sshd certificate that was signed through the use of a hardware key. And all those approved sources should be managed by your corporate IT department, and appropriately locked down by the corporate MDM process. And you might want to think about whether you should also be required to be on the corporate VPN. Or, to be using comparable technologies to access those approved sources.