You know what else blocks RDP brute-force attacks by default? Closing port 3389

Finally! Windows to Block Password Guessing — by Default
Brute-force guessing of Windows credentials is a common entry point for hackers. After 27 years, Microsoft is finally fixing the dumb default that allows it ...