There have been numerous vulnerabilities, back doors, default passwords etc in Qnap products; search HN.
In some cases devices have been attacked with ransomware even in private networks (no ports were opened to internet) through UPnP.
I'm not pretending a network drive is local, but actually mirror the important data from my NAS to a locally connected 14TB USB drive. It stays connected all the time.
I have some cron jobs that run rsync scripts, but the data that needs to be backed up rarely changes. This gives me 30TB on my NAS, of which, 14TB are backed up in backblaze for $60/year.
I can make this work in my situation because the items I want backed up are less than the working space I want on my NAS.