"there's literally no good reason (besides laziness) to leave sshd exposed to the public internet."
Well, besides the fact that it's a whole lot more convenient to just be able to ssh into somewhere without frigging around with VPN or what not. For most businesses, I would say having accessible ssh (with good passwords, and a properly set up, up-to-date system) is fine.
But yeah, for a "security" business .. it's pretty surprising they let it hang out like that. And on port 22 and the www domain, too .. tsk tsk.
If there is an option between a convenient way to do something and an inconvenient (but much secure) way to do the same thing. You should do it the inconvenient way, specially if you make a living in security.
If you're at home, running OpenBSD on your own computer, then security can be inconvenient as you want it. But if you run security for a business, you have to balance confidentiality and integrity with availability (and sometimes some other concerns). Shell access from the internet could be important to availability--obviously, this was the wrong way to do it, but it wasn't a wrong objective.
I agree with your point, but I do want to point out that mail theft (by postal workers, errant receivers, and malicious thieves) is not so uncommon. I have had a few things mailed without tracking numbers that I strongly suspect were stolen (mailed from post offices with complaints of theft or undelivered mail).
Well, besides the fact that it's a whole lot more convenient to just be able to ssh into somewhere without frigging around with VPN or what not. For most businesses, I would say having accessible ssh (with good passwords, and a properly set up, up-to-date system) is fine.
But yeah, for a "security" business .. it's pretty surprising they let it hang out like that. And on port 22 and the www domain, too .. tsk tsk.