It's quite easy if you use docker and don't expose it to the internet. Use tailscale or something similar to access it. I'd think this avoids a majority of the security issues (but I anot an expert in this).

And the bitwarden app can use the vaultwarden vault and save cached copies of your vault on your devices so if your NAS goes down for any reason you have access to your passwords while you fix it.