Keeping port 22 open puts you first in line for such exploits

SSH RCE is a super expensive exploit - no one is firing that one while it still is a 0 day without having really important reason or juicy target.