I disagree. Suppose the latest SSH has a 0-day, now I am vulnerable, even though I only use PK-auth. Obscurity is just another layer, and the purpose of layers is to help make rare vulnerabilities (like 0-days) not compromise the system. By hiding the door, they cannot even touch the 0-day without another rare vulnerability.