I would say it is not only valid but a very interesting method to deal with 0-day exploits and automatic scanners.
I have a number of services running at home, all outside the standard ports - sip is on 5099 (remote gateway is on 5088), SSH on 5225, etc - and the difference in the number of attempts to log into my box (and make international calls..) is huge - actually, I did not have a single attempt to put a call through my asterisk box since I changed the ports outside the default range.
Of course, it's not the only security measure, but I'd argue it can be as important and as effective as any other.
I have a number of services running at home, all outside the standard ports - sip is on 5099 (remote gateway is on 5088), SSH on 5225, etc - and the difference in the number of attempts to log into my box (and make international calls..) is huge - actually, I did not have a single attempt to put a call through my asterisk box since I changed the ports outside the default range.
Of course, it's not the only security measure, but I'd argue it can be as important and as effective as any other.