If you're building a botnet you don't need to crack any specific machine so you can distribute your attempts across more hosts. Eg. rather than hitting one machines with 1,000 pwords/sec you target 1,000 machines at 1 pword/sec each (or whatever rate you're limited too). There's no shortage of badly configured routers.
I'd go further and just argue that password based login should do a password strength calculation by default and estimate how long it will take you to get cracked.
"You've entered the password this machine will be cracked in roughly 5 days. Would you like to set a different password? (n / Y)"
http://money.cnn.com/2015/09/30/technology/china-opm-hack-us...
"When installing SSH always set it to key based login only NO Password login allowed"
Passwords are not to be used here they can be broken by automated distributed attacks, strong cryptographic keys won't.
Passwords can't really be gotten that easily.
PermitRootLogin no
PasswordAuthentication noBurp suite can easily crack web logins if you allow hundreds of logins per second for a single user.
I also used to run http://www.symantec.com/connect/articles/slow-down-internet-... on some of my hosts. It was fun for a while but caused me to have one too many lockouts.
It's possible and fairly straightforward to disable autostart of services through either old-school SysV init or, I suspect, systemd.
Upshot: running complex systems isn't entirely trivial.
But regardless, starting sshd on installation shouldn't matter because proper passwords and firewall should be the first step.
Due diligence on my part was lacking, agreed.
Defaults matter: not implementing rate limiting by default in sshd has left an open door for these people to walk through & attack the net. Sure, you can blame people for choosing poor passwords but, given the reality of the millions of machines out there, as programmers we know that some of them will have poor passwords because people are people. Failing to code with that expectation in mind is doing our users a disservice.