Yeah, but xrdp doesn't. And there are plenty of exploits available for RDP servers of either flavor. I'd never leave RDP open on the Internet.