You should include in your security best practices a mention about RCON being unencrypted. That is by the specification, I recommend, myself, to never expose the RCON connectivity to untrusted networks. Your web console should be preferred if possible (and with certificates, especially over the internet). The RCON password could feasibly be snooped on an untrusted network or the internet, making a server vulnerable to griefing and anything else possible with console administrator access of a Vintage Story server software.
The RCON access should always be used with necessary precautions, be it restricting access to only the local host (requiring a more secure connection first, such as SSH, to then interact with the server via an RCON client) or using a VPN setup such as wireguard or IPsec to ensure connectivity between RCON client and the server is encrypted.