A number of years ago now, there were several remote exploits for OpenSSH which prompted many admins including myself to start filtering port 22 at the network perimeter, permitting only IP addresses of staff to use SSH. It was a common practice.
It made sense then, but does it make sense now?
I'm talking about the security and exploitability of the ssh daemon itself, I'm not worried about bots trying to brute force password logins. In my shop, ssh is already locked down; root logins are disabled, only public key auth is used.
Basically I'm asking if there are kiddies out there that have been sitting on OpenSSH zero-day for 9 years? A guy I work with assumes so and his logic is "because it's a server". I find his belief questionable.