In general, I'll start by saying that in general, the more services you run and expose to the internet, the greater your attack surface and higher the risk of compromise. We can break the risk down into two areas: those you can control, and those that are beyond your control.
Risk you can control
As with any remote management protocol, there are automated tools that will knock on your door all day, trying to brute force your password and log in.
Things you can do to help protect against this:
- Limit access to trusted devices/networks using firewall rules. This can hugely reduce the attack surface.
- Use a strong password.
- Change to a non-standard port (you've already done this). This will foil the majority of automated tools but will not slow down a determined adversary.
- Enable two-factor authentication (you've already done this).
Risk you can't control
There are several factors that are usually beyond your control:
- The RDP protocol. It's possible that a serious vulnerability exists within the RDP protocol or its server implementation. This type of vulnerability is difficult to audit because RDP is mostly proprietary. However, there have been 0-days in the past where simply having RDP enabled and exposed allowed for remote code execution (MS15-067).
- Similar concerns with Duo. Their application could be flawed, backdoored, or allow compromise to your system if Duo's cloud-based systems themselves are compromised.
- If you're remotely connecting, it may be possible for someone to man-in-the-middle your connection and trick you into accepting their certificate.
It really comes down to your level of risk tolerance. If you fully trust that Microsoft and Duo are following best security practices, then that may be enough, in addition to following best practices. To further mitigate against these potential issues, requiring connection through a VPN or SSH tunnel could be used to add an additional layer of security.