It is a matter of debate whether it is really necessary, but there is definitely a good reason for having some form of protection.
We live in a digital age, and if you have RDP access to a server, hackers will scan the internet continuously finding machines to find servers with RDP open. Once they find it, they will hack the server using various methods and once they are in, they will install a cryptolocker hijacking virus and demand money to release your machine.
I've seen it happen more and more in the last 2 years so it really is necessary to put in some form of protection, as just your username and password is not enough. There is a strategy to have different ports, and this will keep out the majority of hackers, but the really determined ones will still find you, so this is only delaying the hacking attempt.
True protections come in the form of setting up a whitelisted IP to which you can connect from, or setup a VPN solution. Alternative solutions that work well are RDP firewalls that will ban ip adresses automatically after 5 failed login attempts. This is the strategy I usually go for because it allows the most flexibility while still offering very good security. The downside of this over a whitelisted IP approach is that hackers still find your server and can choose to break in by continuously trying different passwords from different servers which basically means they're doing DoS attack on your server. Only the major players will be able to launch such attack, but they are getting more and more present.
You can talk with your hoster and ask if something like RDP Defender or RDP Guard is acceptable by them.
