One defense strategy that mitigates some of these threats is requiring all "back-door" access from the public internet to go through a few minimally-configured,

One defense strategy that mitigates some of these threats is requiring all "back-door" access from the public internet to go through a few minimally-configured, easily audited bastion hosts. (As in, packets from outside to port 22 on machines other than the bastion hosts just get black-holed.) After which, of course, an audit is part of the process of locking people out, along with cancelling credentials on the bastion hosts specifically. This doesn't cure everything, of course. There are a lot of places in many server environments where a determined miscreant can hide time bombs. (Oracle DBMS_JOBs anyone?) But it can be a useful component of defense in depth...