>If there's a remote-root buffer overflow for sshd that does not involve login at all, doesn't hiding the sshd add quite a bit of value ?

Then the attacker can just compromise every single sshd on the internet and have enough bandwidth to bruteforce most port knocking setups.