@hacks4pancakes an analogy:

Why aren't the admin and monitoring parts of servers and datacenters not air-gapped? Just turn off all ssh access. If you need to monitor or admin your server do it locally from the server room. That would prevent a lot of attack vectors.