You asked why it’s discouraged to expose SMB to the Internet, and then asked to differentiate replies based on versioning. Given that Azure will happily expose SMB to the public Internet, I suppose that’s a fair question.
Microsoft used to recommend not exposing SMB to the Internet. Then they went silent on the matter (please correct me if I’m wrong).
It’s important to keep in mind that Microsoft has made many poor security choices for self-interest and does so with some regularity. They also have an organizational culture of “yes but we can do it”.
Speaking as a professional sysadmin, I don’t expose any service to the Internet that is not designed for and intended (by use case) to be exposed to the Internet. While I might not ever expose SMB, I might expose SSH on a bastion host so I can access it.
SSH, internal tools, CIFS/SMB, KBs, etc, are all behind some kind of SASE, VPN, or bastion and IP allowlist.
The reasons are varied, but the themes are broad. The fewer the protocols exposed to the open Internet, the lower your attack surface. Exposed SMB has historically been something of (either) a honey pot or a signal that a network has subpar security management, and so you may see a commensurate increase in malicious traffic. This holds true today.
That also means if you decide to expose SMB to the Internet, your credential policies and management should be excellent. Every endpoint accessing the same share with the same credentials means everyone has the same identity from the server’s perspective.
Do you need to use SMB exposed to the Internet to achieve your goals? If so, setup a host specifically for that and put it in your DMZ. Make sure SMB is the only thing exposed. In the alternative, go with something that was architected with the assumption of Internet exposure being the default, like SFTP. You can manage some SFTP applications just like you can manage GPO/MDM and drive mapping.
Another way of thinking about this is trust levels. If you need to maintain some kind of highly trustworthy environment in one area of your network, you’d do well not to expose potentially sensitive services like file sharing to the Internet. At least not services in the same network segments. You cannot assume that all malicious activity will be obvious or detectable (or detected!), and you also can’t assume there won’t be another SMB zero day like WannaCry.
TrueNAS is designed with the assumption and accompanying admonition that it’s not designed to be exposed to the Internet, so there’s also that. If you still want to do that, you should personally review the generated Samba configuration to make sure it meets with your security assumptions.
Another thing worth thinking about is MFA. It’s trivial to protect a VPN with MFA. It’s far less trivial to protect SMB with MFA, but if you’re in a scenario where you have to have users sharing identities, you’re already up against some challenging requirements to keep secure.
