Hopefully, all of us have some level of control over what / who connects to the home network. The same cannot be said when you expose ports / services / NAS’ to the internet. Clearly, the most secure option is to run your NAS off a battery while air-gapped inside a faraday cage. Most of the time it would be kept electrically-powered-down, and only boot it up as needed. Everything beyond that becomes a trade-off re: security vs. convenience.
Most of us are likely in violent agreement re: limiting the potential impacts of naughty attached devices. Good hygiene is a must. VLANS, dataset / share permissions, snapshots, SMB encryption requirements, WiFi security, hardening end-points, ensuring users have malware detection, etc. all go a long way towards putting up more and more layers to help keep the data secure. But will it be 100% safe? Never. That’s why we have backups, ideally off-site and un-powered.
A firewall does not protect from the kinds of privileged attacks you describe above. Authorized users encrypting content via ransomware can likely be best mitigated with checkpoints, snapshots, and IDS tools that scan for suspicious network behavior. The firewall issue you seem to describe is more likely related to limiting access to the guts of the NAS, for which a hardened gateway / switch is likely a better answer. i.e. no access other than from a specific reserved IP on a isolated sub-net with a hard-coded MAC address.
That is what encryption is for. Both for the hardware (i.e. encrypted pools) as well as specific datasets / archives / files. Nothing prevents you from making the data functionally useless unless an attacker has the keys to the kingdom. So you can encrypt the pool to make physical theft of the data less possible and then host encrypted archives for the stuff you’re also worried about other users snooping into.
All comes down to how much you value your data. We have plenty of stories here that describe precisely what you claim is unlikely. We care about bit-rot for a reason. The more cautious folk here keep off-site, electrically-dead backups for a reason. Many also have off-site machines they can replicate stuff on an hourly basis to. All comes down to budget and willingness to do the work.
I happen to have a different opinion re: the use and benefit of a firewall for the NAS when I can/have program(med) one quite easily via the switch / router on my home network. That firewall remains persistent across reboots / upgrades / etc. and requires zero work for the iXsystems team.
All that said, a better effort may be to set up a IDS to log / highlight suspicious patterns. That could be as basic as a Raspberry Pi (see the honeypi project, among others), up to more sophisticated IDS’ based on N100 platforms that scan all network content. Good luck.
