I agree with your observation, but this is merely put fwd as an alternative to port knocking.

Port knocking is IMHO just to keep your sshd logs clean from huge lists of failed attempts, that prevent me from actually finding interesting information in them.