You could say that for any service though, yet we still run services on standard ports. Why? Standardization.

Apart from the usual suspects such as rate limiting, only allowing public key authentication, using/enforcing sensible passwords, and/or blacklisting with firewalls (which are also very easy to set up, low cost, effective as well, and objectively better) how about not having a SSH server exposed to the entire world in the first place? Or having only a SSH server exposed, and for the rest nothing? (And even then, it still doesn't make sense someone in China can access your SSH server located behind your DSL or cable router...)