No difference. Exposing RDP is one of the top reasons for hacks and ransomware infections.Server 2016 is basically a reskinned windows 10 (you can see the xbox servives and other desktop crap in it).
Not sure what's your point there. It's retarded to expose any services that allow root access (RDP/SSH the same).The sudo stuff is an escalation bug. RDP had a long string of serious, remotely exploitable vulnerabilities too.Hit up any devops/sysadmin forums and ask what they think about opening a port for RDP without any restriction.