Or how large companies actually think about this risk in the real world. Expose SSH ports to the public internet willy-nilly and count the seconds until their ops and security teams come knocking wondering what the heck. YMMV of course, but that's generally how it goes.

Are critical SSH vulns few and far between, as far as anyone knows? Yes.

Do large companies want to protect against APT-style threats with nation-state level resources? Yep.

Does seeing hundreds if not thousands of failed login attempts a day directly on their infrastructure maybe worry some people, for that reason? Yup.

You call it consultant distraction speak, I call it educating you about what Wireguard actually is, because in your original reply you suggested it was password-based.

>Further, they serve two different purposes so its comparing Apples to oranges in the first place.

Not when both can be used to protect authentication flows.

One is chatty and handshakes with unauthenticated requests, also yielding a server version number. The other simply doesn't reply and stays silent.

>Simple software can have plenty vulns, and complex software can be well tested.

In this case, both are among some of the most highly audited pieces of software on the planet.