It would be my preference to place the Dude physically behind a gateway router/firewall (on a different device than the gateway router) etc. However, if equipment needs dictate that the Dude goes on the gateway router, what kind of issues would I need to be aware of (I'm new to routerOS & feeling my way forward)?
thanks so much!

Nothing at all. if any - connection to dude port - default 8291. If you are really concerned - block all traffic to the port and connect trough a VPN. If a bit less concerned - open acces to spesific ip/range. in practic use - just run it open. Its no problem with that (unless you are a new precident candidate, want to hide illegal stuff from FBI etc)