As others have said, you might want to modify sshd_config. However, I disagree that that is a big deal. Just write a little script to fix whatever you want to modify after a major system upgrade. If you are messing with sshd_config, you should now how to write a script to modify it. It is not protected by SIP. I don't understand why so many unix competent people seem to think this is a big problem.

I’d imagine no os has a way to see if changes are made by the user or by malware, otherwise you’d just prevent the changes.