> but that doesn't mean "public keys are not enough for SSH security", right?

With direct key-file access, bruce-force is very fast so it will depend on the passkey length.