Whitelist in use to allow connections only from the admin account, enforced.
Install all new updates automatically, enforced.
On top of that there's a policy attached to the custom host module deployment that specifies the following things for every host:
TeamViewer custom host module with account assignment for the admin account (easy access/unattended access) enabled, so the deployment happens with the specific api token.
Full TeamViewer client for admin to give remote assistance (random password disabled).
TeamViewer account with a complex password and 2FA enabled.
Now I decided to come seek professional and objective opinions about the security of the following scenario:
I'm a systems specialist in our organization and I've read a lot about TeamViewer security concerns over the last few years.