I think the main goal behind port knocking is to prevent someone from exploiting a pre-authentication vulnerability in the ssh daemon.