Sure, which is why one would run RDP only via a VPN.
Indeed. Or one of the Microsoft perimiter security software solutions.
If one cannot get the VPN up (e.g. lack of password) then one will not reach the internal network on which the RDP server is sitting, surely?
If that's how the sysadmin has configured your perimiter, yes.
If VPN has been configured as your only way in, then that wil be your only way in.
Are you saying there is an issue there, e.g. the Ipad is prone to connecting without the VPN being up?
The iPad (or any other device) can only connect to what you have opened up on your network perimiter. Don't open up the VPN port and it can't connect to that either.
That is certainly a problem in a normal "travelling laptop" scenario where you open a VPN to your office (e.g. to check your POP email securely) but if the VPN connection drops, the email client will happily carry on making the access without the VPN
Only if your sysadmin has configured such a fallback mechanism.
With a browser one can force VPN-only operation.
As above.