"Wasting resources" to a fairly trivial level has nothing to do with "security".
If you disable password authentication, there are no authentication attempts, and the connection is immediately aborted during the handshake as soon as the client announces it cannot authenticate by key. It thus...