I am far, far from being expert, and exactly that would be the reason I wouldn’t allow myself to try to access dom0 (and templates) remotely.
Now, since mostly any online AppVm is considered by default to be compromised, the worst I’d allow myself would be to remotely access online AppVm, the one I intentionally left up for this purpose. And that AppVm wouldn’t contain any sensitive or valuable data.
More about this could be found here