Unless an attacker already has access to private infrastructure, yes. There are a few other requirements such as allowing password login to ssh, which should generally not be a thing (but unfortunately is).