Always protect your OpenVPN instances with tls-auth, especially if your instance accepts connections from any IP. It prevents the SSL negotiation from even occurring if it doesn't match. It would have protected you from heart bleed, and it protects against shell shock.

There is no downside to using it. However, keep in mind that the key file is shared across all clients, so you probably want to change it periodically depending upon how much you trust your clients not to become hostile. You could run multiple server instances on different ports/IPs to subdivide your client base, or when rolling out a new key.