[Lk7Of3vfJS2n]

The point of that tunnel may be to prevent entities that are inside the VPN from sniffing cleartext RDP traffic. If an attacker gets VPN access you want to limit their ability to do damage inside the VPN.

[cpach]

Could be. I think these days RDP has support for TLS 1.2 though.