I used to have a synology NAS that would sleep of death itself. Synology support asked me to port forward SSH to the open internet and set no password so they could pull logs over the next few weeks.

Yes, it was legit synology support not a scammer.

No, I haven’t bought synology ever again.

Any VPS provider just gives you an SSH IP and port. So that's the default state, until you do something else, which I imagine many don't, since key based authentication was always considered secure.

So I don't know the reason, but that's the standard practice with most providers, like Digital Ocean or Linode or whatever. You can call them maniacs but you shouldn't be surprised at something so ubiquitous.