> Think about how long an SSH server with password enabled and no autoban would last in the open

quite long? unless you're using a bad password I don't really see any risk other than filling logs from password attempts.