See my other comment, but the basic problem is you are only putting one layer of protection if you expose directly to the Internet. If there is a vulnerability in NAS, then bots can exploit just that layer and get in.
If you have tunnel/VPN then NAS, they have to have a vulnerability in the VPN, then also be able to use the VPN to exploit the NAS (or some other device on the VPN).
Add another layer, like IP limitations on the tunnel, then you have to have 3 exploits. Etc...
Synology sells based on convenience of features, and good enough security as a second thought. VPN or tunnel software exists to provide security. So you want to mix the focus and the providers to minimize chance any one provider or mistake will let you get hacked.
The biggest risk for a typical home lab is from bot scanners and not targeted attacks, so they are unlikely to target a connection with more than one layer as there are many, many simpler targets.
See my other comment, but the basic problem is you are only putting one layer of protection if you expose directly to the Internet. If there is a vulnerability in NAS, then bots can exploit just that layer and get in.
If you have tunnel/VPN then NAS, they have to have a vulnerability in the VPN, then also be able to use the VPN to exploit the NAS (or some other device on the VPN).
Add another layer, like IP limitations on the tunnel, then you have to have 3 exploits. Etc...
Synology sells based on convenience of features, and good enough security as a second thought. VPN or tunnel software exists to provide security. So you want to mix the focus and the providers to minimize chance any one provider or mistake will let you get hacked.
The biggest risk for a typical home lab is from bot scanners and not targeted attacks, so they are unlikely to target a connection with more than one layer as there are many, many simpler targets.