> If it's on your LAN, you probably have physical access to it and that's basically a factor in itself. Just because it's a LAN doesn't mean you have to be ph

> If it's on your LAN, you probably have physical access to it and that's basically a factor in itself. Just because it's a LAN doesn't mean you have to be physically present to access the device. Another device on your network could be compromised, giving an attacker access to anything that the device can access. For example, say you get tricked into downloading something nasty on your laptop. Now they have remote access to your laptop, giving them access to your NAS. Ultimately it comes down to your threat model. For an average home user, it's probably not very likely that not having 2fa on LAN-only devices would be a huge risk. But for a business with thousands of employees that could plug who-knows-what into your network? Much higher risk.