I've heard multiple multiple times to never leave SSH with a password open over the internet. Why is this so bad?

I understand the password can be bruteforced, but what if it is a very strong password that would takes eons to crack?

Are there more things to consider than just bruteforce or am I missing anything else? 


  Why is this so bad?


Because there are tons of bots just scanning the web for open ports and trying to log in, once a scanner bot finds an open SSH port it may be queued for another bot (or botnet) to try to brute force the password. One of the risks here is that eventually, they may succeed in figuring out the password and take control of the server.


  I understand the password can be bruteforced, but what if it is a very
  strong password that would takes eons to crack?


Having a long password is a mitigation technique, however the resources (bandwidth, disk space used for logs and CPU for example) consumption of a brute-force attack can also be damaging.

Mitigation

Some techniques to mitigate a brute-force attack on SSH:


Use a different port, don't get a false sense of security with this, but many bots do search for 22 exclusively. (Related question)
Disable SSH passwords
Require a private key for logging in
Throttle connections
Implement an IPS (Fail2ban and Snort come to mind)
Restrict login per IP address
Restrict which users can log in (different than checking the IP address)

