They are good for people with limited experience of security and networking but who need remote access to their environment.
I use something on my own service too. The difference being that I leave it turned off normally and only turn it on when I (rarely) need it.
Which is good for those people who have the knowledge and the time to set it up properly. The cloud services provide generally strong security (with both the caveats about (a) trusting the vendor, (b) making sure that remote devices and networking are not compromised).
And that is an important point. You don't need to expose a web endpoint if all you need is a simple switch or two and some simple data responses.
You think you SOLVED a problem with that?! When this thread is all about preventing cyber attacks on Node-RED systems?!!!!! 
You are doing the opposite.
I'm not actually convinced that those attackers got in via SSH, there are easier attacks if you have the tools. But the reason for moving the port is to stop simple port scans. The automated scans that start a few seconds after you expose a device to the Internet. Moving to a non-standard port stops the majority of those and when I last tried, it killed off 99%+ of all SSH attacks on my systems (a couple of VPS's so they were always going to be Internet facing).
I agree with the comment that it is best not to expose SSH at all if you can help it. Indeed, the best security is no exposure at all 
Just not terribly practical sometimes.
Haha, even I won't do that! 
I refer everyone back to the FAQ thread on security that I referenced earlier.
If you really think you need to expose a web endpoint, you have to accept there are risks and you need to prepare for them. Preparing isn't necessarily that hard but it is detailed work that you need to do carefully step by step. If you are not prepared to take the time or don't have the time, please do us all a favour - don't expose to the internet. Cyber failures don't just impact you, successful attacks often lead to systems being used to attack others.
Security starts by not making assumptions. For example, if you are using a Raspberry Pi, you probably just launch straight in and use the Pi user and group and maybe do the passwordless sudo thing that I objected to above - sure, we all do that! But once you start considering other people accessing your system, you would be better off creating a new install and making it secure from scratch - well before even starting to layer the additional services and node-red configuration changes required.
It is also a reasonable (not terrible) amount of ongoing work to keep a system secure. Again, if you aren't prepared to do that, don't even start please. You need to be regularly updating all of your software and keeping an eye out for improvements you need to make such as better logging and alerting. I tend to use an auto-update service on Linux devices so I don't have to think about updates too much. That might break things occasionally but better than being exposed unknowingly by out-of-date software.
