RSA key exchange is still secure, but you lose PFS when downgrading to it since very few servers will generate ephemeral RSA keys like they will when using DHE.

RSA key exchange is still secure, but you lose PFS when downgrading to it since very few servers will generate ephemeral RSA keys like they will when using DHE. 3DES is secure, but slow. Ideally, you would want to just disable all ciphersuites that don't use ECDHE to do the key exchange, but that would probably hurt compatibility.