I personally find it nicer to unlock my phone to decrypt (Face ID) then dealing with having to auth with my headless server. Is there a way to manage this without putting the keys for LUKS or similar somewhere risky? Main threat is someone stealing the NAS during a break in.

You can store the key in the TPM. If someone steals the NAS, they can only decrypt it if they continue running the exact same software, which you harden (e.g. disable password login from the TTY).

Or you can SSH in and type the key once per reboot.