So how do you manage the risk of a user connecting to a remote desktop with an un-updated machine full of malware? In the end if the client machine is breached

So how do you manage the risk of a user connecting to a remote desktop with an un-updated machine full of malware? In the end if the client machine is breached the remote virtual one will also fall?