It's getting a little painful so I'll keep it short; the point of moving the port is to have a time-window to respond when a ssh pre-auth exploit is discovered

It's getting a little painful so I'll keep it short; the point of moving the port is to have a time-window to respond when a ssh pre-auth exploit is discovered (since automated bots don't hit your daemon when it's on a high-port). The rest of your comment (faith in privileged ports, hollywood attack) doesn't lend much credibility to your advice.