SSH does not actually defend against keystroke timing attacks. To my knowledge, no actual case of password recovery through timing analysis of a SSH connection has been spotted in the wild; however, since nobody in particular would have kept me informed if that had been the case, what does it prove ?
This report claims that the Song-Wagner-Tian attack is too difficult to pull off on a practical network, because the latency implied by the network masks the delays between key strokes. One may notice that the purported attack relies on a learning phase in which delays between two specific letters are first gathered (for a specific victim); that phase looks hard to do in practice. Another vexing issue is that an oft-typed password usually has its own delay patterns; that is, when you type the same password again and again, the delay between, say, a 'v' and a subsequent 'o' occurring in the password will be quite distinct from the delay measured when the "vo" letters appear in a non-password text that you also type.
Note: SSH includes some random padding, at least four random bytes (see the standard), but this is meant to avoid some potential weaknesses of the used block cipher. It does nothing about timing.