Obviously, the risk of having RDP enabled is greater than the risk of not having it.
Risks of having RDP enabled in the local network
By enabling RDP, you are allowing connections between computers, providing an easy way for an attacker to perform lateral movements inside your company. Someone that compromised one computer and was able to escalate privileges locally could easily compromise all the computers inside this network.
Moreover, vulnerabilities in RDP (like BlueKeep and friends) may make the computers vulnerable even without having valid credentials.
Risks on RDP being accessed from the outside
Here you are relying on (a) the hardware firewall (b) computers connected through VPN or (c) a regular internet router in order to avoid RDP access from outside.
If the computers are inside of one building and never leave it, your firewall could ensure that no remote connection goes into an internal 3389 port. But if it's ever outside the premises (e.g. telecommuting, business trip…) it's no longer easy.
- USB 5G dongles may happily provide a public IP address to the computer, reachable from the internet.
- Though there is a VPN connection, the computer may nevertheless be accepting RDP connections directed to the public IP
- Even when that's not the case, the computer would be vulnerable to remote connections before the VPN is started or after its shutdown
- Even if the computer which VPN in is used behind a home router which fences it from the internet (through firewall capabilities or NAT), other computers in that home network may be infected / compromised.
You may think your computers won't actually be exposed on the internet that way, but I have seen many computers that were accessible via RDP at consumer dynamic IP addresses (and were not expected to be).
If you really want to enable RDP, I would require Network Level Authentication and filter out in the firewall of the local machine any incoming connection to 3389 not coming from some designated range which is the only you will ever RDP from (e.g. 192.168.33.89, using a RFC 1918 private address should make it harder that an unintended connection gets inadvertently routed from outside).
A point worth keeping in mind when designing this are all those companies that got infected by WannaCry on 2017… while nobody had smb port open from the internet.