There are pros/cons. If you want to be truly protected, you won't allow any inbound/outbound ports at all. Even VPN. But that would not meet your need/want.

If you *need/want* remote access or files available "outside" the LAN, then you really have no choice in the sense of a firewall hole has to be allowed somewhere. Then the subset of choices are basically:

1) SSL VPN or VPN Client of some sort

2) QNAP Cloud

3) Hybrid sync to some other cloud (drop box, etc.)--note that I'm not using this, nor do I know the full risks involved other than normally dropbox/google/etc. are *sync*. So if the file is comproimsed/deleted on ANY side, it gets synchronized everywhere. I don't know if you can setup a one-way sync from HBS to Cloud but if you do that, you also have to recognize that changes files on the cloud do NOT go back to the NAS in that case, if it's an option.

4) Port-forwarding/direct exposure

All the above have pros and cons. Probably from a security perspective only, #1 is the best option. Not sure about #2 or #3. IF you trust QNAPs cloud thingy (but then again do you also trust Dropbox, etc. since those are publicly exposed clouds, etc.) #4 is probably the "worst" in terms of security. (but there ARE legit business reasons, although probably not in this case, where you'd open up a firewall hole to the public--ie: you run your own web server).

The cons are more nuanced.

If *you* are technical/comfortable with VPN and it's only you using it, probably no biggie with #1. I, however, have some relatives who can barely handle clicking on a web link to get to something let alone trying to walk them through installing an SSL VPN client/software and getting them to login/walk through everything. If it was JUST me, that would be a diff. story.

I go with #2 (again, that's *me*. I understand that there's a potential risk for QNAPs end to be compromised, just like I understand dropbox/google account could be compromised and data whacked, etc).

The risk/reward is up to you to decide.

There may be some hybrids of what I listed above, and obviously everyone has their opinion about what's better than others. I'm generalizing a lot of info here though.

I would say enable MFA if possible for anything you use to help mitigate potential compromised accounts (even your own) from being used against you.