Thanks. Still learning about security.
Although this stance makes me think I should never use remote desktop at all. There's no place where I could use a computer outside my house where I'm certain that they're following good security practices.
I've had trouble incorporating the TOTP plugin for Guacamole, so I do keep the Docker container stopped until I specifically need it. I do need to get back to trying to troubleshoot TOTP on Guacamole.