Indeed, but might there not better/cheaper ways to secure SSH?

Something that doesn't involve custom configuration that needs to be maintained.. like VPN to a jump-host... Or..?

Configuring and maintaining custom hacks is not cheap.