Ah, I get what you are asking. I think it's far more secure than RDP because the protocols it's based on have learned lessons from RDP.

Here's a document they have about securing Keycloak: https://www.keycloak.org/docs/latest/server_admin/#mitigatin...

I too would be interested to hear from any folks running this software in prod how they deal with securing a public endpoint.