That's the wrong question. The right question is what did he lose because of that. And the answer is likely 'nothing'. So it's a free gain with zero downside, makes good sense to me.
Portscans and SSH bruteforcing are not necessarily the problem, but they can be preludes to a problem.