You're right that it doesn't prevent intrusions from someone who's focusing on your machine, but doing something unusual that requires extra steps of attackers

You're right that it doesn't prevent intrusions from someone who's focusing on your machine, but doing something unusual that requires extra steps of attackers does usually decrease the likelihood of intrusions, especially from automated means. You're acting like bots frequently portscan when trying to brute force ssh, and I can tell you that they generally don't. I typically don't bother, and just use fail2ban, but it's silly to say that it doesn't make it more secure. It does, if only marginally. As long as people are aware that it isn't sufficient, and that they still need to use strong passwords and/or public key auth, then there's no problem with saying that this makes things more secure.