If you use the enterprise version, it doesn include session encryption and can use normal domain level permissions, so it is as secure as your password policy (digital and social). There is no REAL way of easily hacking a VNC line, or making any use of intercepted data. If the server is on the internet directly, it is just as accessable via other undisclosed means.
Short answer is YES...but deffinative, I can't say.
Hope this Helps.
Neil J Cotton
njc Information Systems
Systems Consultant