It's one thing to say without evidence, "I know for a fact that intruders are logging in to my system on SSH." It's another thing entirely to say, "it's reasonable to expect intrusion on SSH, so I'm not going to leave that port open on my firewall unnecessarily."