Especially paired with Fail2Ban preventing any brute force attempts.

But with a WireGuard setup, you need not have the port exposed at all.