Thanks for the explanation - I see your point and it would wise to consider this possibility when looking at this technique.

For my use case though, this reduces load on my server (and prevents clogging my auth log files) by stopping incessant password brute-forcing attempts. I must admit to quickly adding an over-riding ALLOW for the handful of IP addresses that should have access, though!