Yeah. Some services you kinda want accessible directly, but ssh really isn't one of them. Even though it should be safe, as that's it's intended purpose, putting a VPN in front of it makes a lot of sense, especially with how easy it is to setup these days. Anything used for administration is systems should be behind one.