That's a way not to be the low-hanging fruit, but if someone wants this port they're going to find it.

Of course. But the attack mentioned above looks to have simply targeted the default port. Ideally : use a non-default port, and source-IP-based firewalling, and keep firmware up to date.