Don't try to be clever and change the port from 3389 to something else either
Scanners can fingerprint traffic and just blast the other ports instead
I (foolishly) did this a few years ago and luckily I had account lockout enabled
Constant attempts all day long - they were even able to enumerate local users and try to log in as them (fortunately they never could cause the passwords were random keepass ones)
Don't do it, seriously