Obscurity as a tool in security has never left. It shouldn't be a tool you depend on by itself. Update your ssh server when there are patches available. Use strong keys or ssh certificates. Disallow old, broken key exchange methods. Having an allow list in your firewall ACLs helps. Maybe only allow ssh from your internal network and make users outside your network be on the VPN. Maybe even have dedicated bounce boxes between user networks and the production systems.

But putting ssh for those bounce boxes on a nonstandard port that doesn't even show up to a remote system within the network until they've port-knocked on another two or four ports in the proper order on top of all that does not hurt security. Using a separate internal DNS zone that nobody outside your network has access to resolve doesn't hurt. Having your firewall drop packets from invalid sources instead of rejecting them doesn't hurt.