The answer depends on what you are trying to do. I would not take a NAS out of the box and place it directly in on the internet with anything on it I wanted to protect.
Personally, I would [not] give internet access to any server that had data on it I did not want the general public to have access to. I have a NAS that I use at home for storing photos, music, and personal files. I would never make part of that NAS accessible on the internet. I don't want to add any additional risk to the content being accessed or compromised.
I have placed NAS devices and servers on the internet to share files, blogs, etc., and even set up "secure" areas for private sharing with family and friends. The NAS/server is always behind a firewall, filtering is from the firewall plus the NAS/server, and I try to limit the impact of any breach in security by making sure there is nothing on the NAS/server that is not backed up and is not too sensitive if someone should get unintended access to it.
