Piping from syslog is being discouraged because on other systems syslog has a habit of sending SIGHUP to SSHGuard at periodic intervals. Is the case on OS X? If not, including this certainly makes sense.
Apple hasn't released the opensource portions of 10.12 yet (and I don't know if the new unified logging system will even be included if it is). As far as I can tell it does not signal sshguard (same process has been running on my box for 24 hours now, nm doesn't show signal or sigaction in the 'log' binary). If sshguard does get SIGHUP and terminates, I imagine 'log' will get SIGPIPE and terminate which will cause launchd to start both back up.
I haven't tested that. I suppose nohup could be used to improve the plist if necessary.
As far as I've been able to determine, there's no good way to get the new logging system to write out to a file (one can set up a launchd.plist to run 'log' and output to a file, but that seems worse.