>>These days connecting to a private VPN, then using RDP is the most common way to gain RDP access and functionality.
A Windows server configured as an RDS host can also have the separate RD Gateway feature installed. RDG is basically an IIS web site to which remote users can authenticate. RDG is also configured with a list of local (to it) computers which authenticated remote users can access, and to which it can forward traffic. Often that's just the RD host server itself but other machines on that LAN can be configured for access as well. If RDG is set up then you can get into a remote host directly in Remote Desktop Connection; you fill in the Options...Advanced...Connect from anywhere...Connection settings...specify the "Use these RD Gateway server settings" before you connect.

Very common amongst hospital customers, though the same applies: if there's multiple customers to manage, frequently I find credentials stored for expedience in the Cisco VPN, browser or RTS client so people can just select a link and get going. Then these get copied to a notebook when going to a seminar or onsite, in case something is needed urgently. As always, security most often boils down to the human being in the equation. The instance I remember particularly was an employee of a large growing health admin consultancy that was signing up whole US states until one employee got his PC stolen with bad stuff on it. Literally decimated the company. No thanks!

I also find that clients tend to lock down various ports or features, including outgoing VPN apart from their own, with Gotomeeting (touch wood) still able to traverse even the most paranoid client's infrastructure.