“Repeated offenses by the same client address will accrue greater penalties, up to a configurable maximum.”
OpenBSD just put fail2ban inside sshd. PerSourcePenalties watches failed logins and crashes, then refuses the offending address for a growing penalty. It ships on by default in OpenBSD 7.6. The catch is in djm’s own commit note: anyone behind a big NAT or proxy shares one address, so one password guesser locks out the whole office.