…I feel like openssh has a much larger attack surface than a simple binary.

If you’re going to this extent already, you may as well jump on the run0 approach systemd is introducing.

oh no, I can hear rumbling