NAT provides plenty of security. Unless someone is port scanning you they aren't going to find the open port, and even if they do find whatever randomly selected port you NAT'd they'd still have to guess / pen test it to figure out that it has RDP behind it.

If you're that OCD about a VM / RDP being exposed into homelab stick it behind SSL on a guac front end. The guys in this sub being so anal about VPN'ing in for everything in their lab is ridiculous. Sure do it for your business (if you're running one from home), but if this is for you to dabble around and learn things it's completely unnecessary to have everything behind VPN only.

I've seen way to many people say that SSL is garbage, don't expose any of your internal sites over anything other than VPN, not even your Plex etc etc.

To each their own I guess.

If my VM gets compromised and someone smokes my vm or data, I'll just restore from an off-site back up and move on with my life, there's nothing mission critical running at my house.