> The security through obscurity (non-standard port, no root) are both kinda silly but why not

I think these are decent controls when layered with others. The effectiveness differs depending on your threat models, of course, but at the very least it helps reduce the noise seen from most automated scans reducing the effort involved in monitoring your assets.

Fail2ban or rate-limiting SSH into a block table are useful layers to have as well.

Another option is port knocking. Super easy to set up and with 4 knocks it provides 64 bits of randomness.

Disabling root provides more than security-through-obscurity if your sudo config requires a password to elevate: it essentially means you need both your SSH private key and your password to gain root.