No matter how good the setup is, the most obvious vulnerability are always unattended unlocked devices with access to the NAS. Even better if there is some remote session, that isn't properly signed out.

Some very basic discipline will protect you a long way.

Beyond that comes the realm of the dark wizards of HN.

If you like to learn about firewalls try this sword

https://wiki.ipfire.org/what-is-ipfire

but be warned, it is enchanted with paranoia.