Erm, an open VNC port is an invitation. VNC, unless you're using a proprietary extension, sends passwords in cleartext.

Hamachi's a fairly easy way around the problem. SSH tunnels are how I do it, personally, but that's not for everyone.