Split horizon DNS can help you solve this for all services, not just ssh, and not be at the whims of Apple.
But I'm still just confused by the decisions being made over at Apple. I understand hand holding those who don't know much but they do realize that the reason their device is so common among engineers is because it's not too dissimilar from Linux, right? Why attack power users? What's being gained? That's what I don't get.
The Mac is the exception in their current product lineup: every other platform is heavily locked down, and the user’s behaviour heavily restricted.
I strongly believe the Mac is heading in the same direction. See the progression from run what you want, to optional signing of binaries, to right click to run unsigned things, to disable a setting to be able to run unsigned binaries; or “worse”, the way spctl and csrutil no longer function after deploying Sequoia.
I do think part of the problem is not enough engineers asking their bosses why. Or not enough engineers thinking decisions through. I hope to god it's not a lack of engineers that are power users because that's even worse in many ways, but I wouldn't be surprised.