But are these off-the-shelf solutions actually supported for ten years? And since they're usually bought for "easy remote connectivity" and whatnot, that's rather important. Bonus points for updates typically being installed automatically, so people won't even think to check whether it's still updated or not.

I have a NAS made from a 15-year-old computer, with standard parts. It can saturate a gigabit link over WireGuard, so it's good enough for my needs. I installed the latest Linux kernel on it the other day. And it doesn't have random unknown stuff calling home. Since it runs ZFS and scrubs regularly, I'm quite confident the data on it is still in good shape.

I ran a Synology DS418play for 8-9 years. It got OS and security updates throughout that time. I recently replaced it with a TrueNAS setup because I needed a dramatic capacity increase, but otherwise it would still be supported.

Almost all off-the-shelf consumer grade NAS appliances are running unmaintainable OS yocto builds already 2 years out of support, and a list of CVE under active exploitation.

The only really functional OSS NAS exception for small offices is the CephFS builds from https://www.45drives.com , and that is because of included support services. =3