Changing the SSH port from the default can be one part of a full defense strategy. The term "defense in depth" means there is more than one defensive mechanism, typically so that if a baddie is able to circumvent one mechanism, they'll be trapped by another. In this case, moving the SSH port massively reduces exposure to naive port scanners. I agree it's not a particularly strong protection, but it's a practical one (at least until everybody does this, at which point the cloud providers will just start adding port knockers).