Ideally, your port-knocking service is much simpler and easier to audit than your ssh service. It's also much more obscure. So you have a service which is very unlikely to suffer a 0-day vulnerability listening all the time to engage a much more vulnerable service only at those exact times you need it.