Note from another image (the network pre-start script): /var/run/ppp is where the pid of the 3G ppp0 process will be kept.
You could use a -P /var/run/sshd if you wanted to (save the pid of any sshd that starts). Not sure that it would gain you anything though.
Check the 3G start-up scripts (and the ppp0 init stuff) for things that might screw with the "no-firewall" setting and/or any sshd running.
Do not give up -
Any *nix system to which a person has physical access can be broken.
And like vocal, call that binary dripbear if that might help.