Comment by ruthmarx

It's convenient and fail2ban/crowdsec is generally a sufficient safeguard. Bruteforcing isn't realistic so you just have to keep an eye on vulns.

Key auth is obviously better, but password auth is not as bad as many people like to pretend.