I wouldn't generally recommend using RDP directly over the Internet, if only because using a VPN gives you an additional layer of authentication (and the possibility to easily integrate hardware tokens). The RDP protocol does include encryption and, if you're using the newest versions of the RDP client, authentication of the remote server (and potentially mutual authentication via Kerberos-- "Network Level Authentication", or NLA in Microsoft parlance).
The main problem with RDP isn't the protocol, but rather problems with brute force password attempts. Your edge firewall can, hopefully, rate-limit new connection attempts. There are host-based solutions to block IP addresses sourcing repeated brute force connection attempts, but that's only putting a finger in the dike. Good password policy is helpful, but you can't ever be sure that your users aren't using the same passwords somewhere outside of your control (a third-party site that gets "owned", etc). Adding VPN authentication on top of the RDP password gives a belt-and-suspenders approach.
The "con" that I've heard expressed with VPNs versus direct RDP relates to the IP-level connectivity to the LAN afforded to VPN clients. To this, I'd say simply terminate your VPN in a DMZ and limit the traffic in and out of the VPN. This isn't a valid argument for using RDP over the Internet versus a proper VPN.