MySQL server with root user that can be accessed remotely with just a password. How hard is it to break in? I have a MySQL server that has a root user enabled. 
This root user is protected by a password and can be accessed remotely: %.

The reason for this is from time to time I use MySQL Workbench to access the server and run queries directly to see some stats.

I know that this is bad.

My question is how hard is it to break in.

The server has fail2ban installed so I think multiple failed attempts will block the intruder via IP. The password is somewhat strong.

As a follow up, what can I do to still be able to access the server with MySQL Workbench but improve security of the box.
create a user with certain privileges (depends on what queries you run). I also advice to disallow root remotely login.