If it's not needed, it should be closed.
You can never be sure if there are no vulnerabilities in MySQL itself. Here is an example for a DOS attack (and it's not the only possible attack).
Allowing non-ip restricted remote access to MySQL
Allowing remote access to MySQL is not a vulnerability by itself, but there are scenarios where it can be used in combination with other vulnerabilities.
For example, lets say the site exposes a config file: Anybody could read the database connection credentials.
If an attacker can also connect to the database remotely, some or all data is compromised (and other attacks might be possible as well, for example code execution if into outfile is allowed).
But if remote connection is not possible, the attacker can do very little with this information (assuming the password is not used somewhere else - eg ssh - as well).
The exposed config file is only an example. For another example consider blind sql injection: retrieving the database password is relatively quick, but retrieving the entire database would take a whole lot of requests. So being able to connect remotely to it would be quite useful.
Allowing ip restricted remote access to MySQL
(This is just speculation) It seems that you can connect to MySQL using udp, so ip spoofing is possible. I could imagine that any attack not needing direct feedback (as for example writing code into a file via into outfile) might work this way (providing that the database credentials are acquired).
It should also be considered that ssh is encrypted by default, while MySQL is not (and the setup doesn't seem all too easy). This means that most users will use an insecure connection if direct access to MySQL is provided.