ESTABLISHED connection does not indicate anything about the state of things with regard to the ssh protocol; it refers to the state of the connection with regard to the TCP protocol.
Networking protocols are layered, and before anything ssh related can occur, a TCP connection must first be established; then ssh negotiations can occur. In order for you to be able to access the ssh server on the pi, you must leave port 22 open to the world. You can put some restrictions on this from the TCP side via
Port 22 is the common ssh port and every public facing sshd server using this port will report numbers of failed access attempts per day from bots crawling around looking for people who have not secured their server properly. Presuming you have (you mention a strong password), this is simply a nuisance in the logs. If you want to get rid of that, just use a different port instead of 22. That is not protection from anything, because if someone wants to attack your ssh server specifically, they will be able to find it by port scanning. However, the random bots will not bother -- they will just find port 22 closed and give up; port scanning it a relatively expensive task when you are making very long shots to start with.
To have an ssh access attempt fail, you must first have an
ESTABLISHED TCP connection. Again, this does not indicate this is a fully logged in connection. It may, but it would also indicate someone trying to log in.
sudo grep "22.214.171.124" /var/log/auth.log
Will show you the record of the failed attempt(s). Of course, those could be faked if someone logged in as root and edited that file, but if you are using a strong password or secure keys assume they did not. That IP is on the ssh list from www.blocklist.de today together with a bunch of similar addresses that trace back to Hong Kong. They've probably tried tens of thousands of randomly found ssh ports for vulnerabilities in the past 24 hours, and they've probably been doing so for years; the purpose of those lists is so you can blacklist them to get rid of the nuisance in the logs.
But they are only a threat if you do have sshd configured in some completely foolish way, in which case your pi becomes a sleeper in some potential zombie network (that's just a guess -- methinks this is not a weapon they will find that useful).
I disagree with Ghanima's point about disabling root logins, by the way -- if someone has your root credentials and can log in as someone else, they can just
su and it amounts to the same thing. My recommendation is password locked public/private keys, but that's just a preference; as you point out, a 16-byte password is too hard to break to make brute force worthwhile.