[achillean]

It is low, Shodan has found more than 10,000 VNC that have disabled authentication:

https://www.shodan.io/search?query=rfb+authentication+disabl...

And there are roughly 550,000 VNC servers on the Internet:

https://www.shodan.io/search?query=rfb