Hi,
Yes, when applied on the loopback interface, any traffic going to the RE should go through the filter unless if you have more than 1 logical unit on the loopback interface. Each logical unit on lo0 would need a filter to protect the RE.
Would also depend on the prefixes defined in the prefix list.
Do you see the count SSHdeny incrementing?
Cheers,
Ashvin