From what people have told me is the point is to remove automated attempts from logs so that when someone actually works out how to try to connect it becomes a strong signal that you have a real attack and you can check the logs to see if they are using real usernames or some other info to suggest that they know more than just random spam attempts. Normally dedicated attackers blend in with the random noise of the internet.