Only difference seems to be that there all ports remain closed (making it obvious that you're using such a method, since you need some way of accessing it too.) And you get some kind of signal about a port opening if you do happen to get it right, whereas allowing password / key exchange to properly go through after some sequence gives no real signal. It also seems simpler implementation wise than dynamically changing the firewall.