I run ssh on an overlay network so it is never directly exposed to the internet and it is nice to not have to worry about changing ports, fail2ban, knocking. Of course you don't get to do fun analytics on the bots though.
Im using a non standard port in the 40,000 range. Changing the port won't necessarily stop the traffic. A lot of these bot nets will portscan an entire ip of anything that has port 80 open to find non standard ports.
It is much more expensive to port scan against UDP than TCP so a nonstandard UDP port would be a lot safer again. OpenVPN is one of the only services that let you do that though.
I'm pretty sure you can put Wireguard on any UDP port you desire, too.