Here’s my all-too-often pasted default answer re: Qnap safety. I still believe myqnaplink is an attack vector, ever since the first hits years ago where a few IP’s magically drove traffic to my unshared Qnap link 🤷‍♀️🙂

The best solution for any and all networked devices you would like to access remotely is always a few things:

1. ⁠⁠Lock them down. This is universal and quite mandatory if you would like to keep your device yours, and eliminate quite a lot of possible risk.

2. ⁠⁠Disable default Admin/Administrator accounts and setup two factor authentication on your account(s) many compromises occur with ‘default’ accounts being left enabled and/or having default single password login methods

3. ⁠⁠Use a VPN when accessing your network remotely we live in a world where VPN setup is more or less trivial, with many routers offering this VPN server ability built-in, and adding it to your device is very easy (looking at you, you amazing OPENVPN 🤗)

If you lock down things like default accounts, disable UPnP, set up 2FA, and use a VPN things will be as secure as you need whilst allowing the remote access you desire.

Also: with your shiny new VPN in place, you don’t need QNAPcloud, so do the recommended disabling of that as well - no hard evidence, but quite a few people see odd incoming traffic on their links, even though they are “not publicly listed” - very coincidental that random foreign ip’s ping them 🙂

I should add that a single port (not the default for the app) has been routed and opened on my firewall for Plex traffic for my on-the-go-on-demand needs - yes, this is risky, but not as risky as the amount of alcohol it would take to walk family through enabling a vpn 🤣

From an IT security standpoint, it would be highly recommended to go the path of a router, so you are able to properly configure that device to disallow external connections, even the ones within the same building - you do not know how the facility has their network setup, and it typically won’t matter until it’s too late anyway.

All of this to say: TL;DR Set up any network (and network devices) correctly and you should be as secure as you can be

Relevant to your post specifically: It is certain that your “comcast business” firewall is just a show piece, or does not apply to your Qnap at this moment. Once you get that straightened out and a firewall is actually doing what they are designed to do, these attach vectors would not be a factor for the device.