I don't know. Intuitively I would have thought that a NAS that updates itself automatically, with SMB1 disabled, is less dangerous that a NAS that is in theory

I don't know. Intuitively I would have thought that a NAS that updates itself automatically, with SMB1 disabled, is less dangerous that a NAS that is in theory insulated from the internet but not patched for security vulnerabilities (since not connected) and connected to machines that are on the internet and could be infected.