That is great news @jmr
I was going to point out that your netstat was only listing a listener on port 3389/tcp but for IPv6, but not IPv4, which could have an impact.
Ironically, your firewalld allowed connectivity to port 3389/tcp but on the public zone. I have no idea what interface was assigned to the Public zone, not on your machine anyway.
However, it looks like the configuration was altered, and you got it corrected.