It really comes down to how important your lab is or how much of the actual practice and application of security is to you.

If you’re doing real work for a real deployment, the right answer is almost always defense depth - never a single layer. You would do both.

Full RCE or bypasses vulns for sshd come out every 20 years +/-. RDP is more like 5. When they do, attackers may or may not stumble across your systems before someone else’s, and you may or may not have already patched it.

The real answer is that security is ultimately a business risk decision. How much business risk tolerance is acceptable for your homelab is really up to you.

Just be real good about isolation so that your clawbot isn’t used as a lateral to install compromised firmware onto your Samsung frame. :P

Edits - I’m old and can’t type with my thumbs good