[nqzero]

assuming that you have a potentially compromised linux host (or VM)

what level of client-side risk are you taking connecting a freeRDP client to that host ? (i'm not worried about the case of the client infecting the host)

what is the most secure similar application ? i prefer a linux client, though would be willing to consider windows if there was a client that was significantly more secure

[hddqsb]

I'm also curious about this; I don't know how secure the traditional native clients are (FreeRDP, Vinagre, Remmina, etc.).

On the other hand, there are browser-based clients such as Apache Guacamole and noVNC, which are protected by the browser's security sandbox. They require a server component, but that can be run in a sandbox or on the untrusted server. There are some limitations to running in a browser (e.g. some keyboard shortcuts might not be forwarded).