Is it a security issue not using the tls-remote option in OpenVPN? That is not verifying the server's common name. Is a MITM attack possible? Could this be an issue, especially with services like dyndns.org?
If you don't perform any verification on the client side, then indeed you risk a MITM attack.