What I have done to harden SSH is:

• set up pubkey authentication and disable password authentication
• disable root login
• not expose my SSH port publicly; it is accessible only from my LAN and through Wireguard

I have done those things as well, but I have also

• changed my port, to some four digit number.
• port forwarded port 22 to its own vLAN that goes to a pi 0 2 that runs crowdsec as a honey pot.
• I am looking for additional things to run on either that pi or vLAN for security.