I use that strategy, as it's really simple, and I rarely have to change IP addresses. Many providers just hand out the same address every time, others as long as you keep your modem running. A colleague who regularly uses a mobile connection from abroad has a VPN with a fixed IP.

Password login is disabled. The only way to log in as root directly is via the terminal emulator on the coloc's admin page.

How this works in Hetzner web panel where you login you configure that firewall that is in front of your box.

In reality you should use that and then use host based firewall anyway.

this