It used to read .pub and still can.
In past years OpenSSH (specifically
ssh-keygen) stored privatekeys in OpenSSL-defined formats, which cryptographically allow derivation of the publickey (as Steffen commented) but only after decrypting, which requires you to enter the password. To reduce wasted effort and time, if you specified
ssh -i file it looked for
file.pub and if found used the (clear) publickey to 'probe' the server to determine if that keypair is suitable (i.e. present in
authorized_keys, or an equivalent for other software) before prompting you for the password and actually using the (private)key to authenticate.
Beginning with OpenSSH 6.5 in 2014 if you specify
-o or use Ed25519, and with OpenSSH 7.8 in 2018 by default (for all keytypes),
ssh-keygen uses 'new format' files, which contains the publickey in clear and only the privatekey (normally but not always) encrypted, so
ssh can do the probe logic without a
Also if you have the key loaded in an agent process, the password is only specified at the time the key is loaded and both the privatekey and publickey are subsequently available without a password. This option has existed for a long time, but in past years it had to be invoked/configured manually and many people didn't know and/or bother. In recent years it has become fairly common (but not universal) for systems or environments (e.g. Linux distros) to set up an SSH agent for you, either OpenSSH's own
ssh-agent or an alternative like
ssh usually doesn't need the
.pub file. But if you use legacy-format encrypted keyfile(s) not loaded in an agent and don't have corresponding
.pub file(s), you may be forced to enter password(s) for key(s) that then is(are) skipped because the server doesn't accept it(them).