As I understand it Ed448 was only recently added to openssh, so maybe it was chosen in order to evade detection by analysis tools that scan for keys (if such a thing is possible.)
Malware authors frequently change the crypto magic numbers to prevent detection.