Yeah, well, those quotes are fine from a marketing perspective. But no, I can have an OpenBSD with SSH open and be perfectly fine unless an exploit for SSH appears. And OpenBSD has PIE, so even with a vulnerability you are protected somehow.
"protected somehow" sounds very marketingish 
and trustworthy, too. Seriously, you compare a full featured OS with a hypervisor OS in terms of security. VMWare never had the intention to replace an OS and therefor at some point they have to make the underlying OS as compact as possible for the hypervisor use.
You also can't directly compare a KVM based hypervisor with VMWare, completely different approaches in terms of a hypervisor.
But I understand what you say, however, you need SSH enabled often. It is like saying do not expose Apache when you have a website running. I agree it is better if SSH is only accessible from certain IP addresses but... I believe the service is robust.
And again comparing apples (ssh) to oranges (Apache). You can perfectly leave SSH enabled with VMWare on your management (internal) network but not exposed to the internet without additional external protection.
How to protect the vSphere login (you definetively need that run on a standalone host)
Yes, but only on the management network.
You can still use a VPN connection to the internal network to manage the host from remote.
I don't think that your box was hacked through an exploit, was just the distributed bruteforce way JarryG mentioned above.
And for your other/older hosts I would take them off the internet ASAP, those guys may come back and hitting the IP of that other host(s).
