Any VPS provider just gives you an SSH IP and port. So that's the default state, until you do something else, which I imagine many don't, since key based authentication was always considered secure.

So I don't know the reason, but that's the standard practice with most providers, like Digital Ocean or Linode or whatever. You can call them maniacs but you shouldn't be surprised at something so ubiquitous.