I think ssh with passwords are a security risk and use key only logins.

But even then get hit with numerous attempts which fail2ban does not help that much; because of the different ip being used in the bots