It'd be pretty impossible to port-scan a .onion... I can't imagine one circuit lasting as long as you'd need to find some random SSH listener.

It's much harder to find than an IP on the Internet; I've never seen brute-force attacks coming from even a standard-port ssh hidden service.