> only units which are accessible from the internet

Sort of. Accessible via Asustor's own software which they'd been promoting to users, which I'm pretty sure had some kind of hole punching / bridge node setup so that you could use it even if you were blocking all inbound connections to your NAS. Obviously if you completely disconnect it from the internet in both directions then you're safe (but also can't get updates etc.)

I plan to keep mine in an egress only state behind NAT (It can connect somewhere, but it's not reachable). Maybe, maybe I'll include it in my VPN setup.