xz backdoor prevention using hosts.deny?

[Nick Sal <specialroumpa () proton me>]

Hi,

Assume we filter SSH access only to a public domain subnet using the files hosts.{deny,allow} as seen below.
Would this prevent an attack if a malicious payload was *not* sent from the allowed subnet?
Trying to figure out if an attack like this was still possible, for the few days in March the backdoor was active and 
undetected in rolling distros (e.g. debian testing).

/etc/hosts.deny:  sshd: ALL
/etc/hosts.allow: sshd: "a_subnet"

Moreover, allowing only public-key authentication for SSH does not help, isn't this right?

Regards,
Nick