Unless you open router ports specifically, routers block connection requests coming in from the internet. But nothing is 100% secure. You could download a virus or malware many ways, even by just visiting a "poisoned" website.
Make sure all computers are running automatically updated anti-virus software. You could also disable UPnP if your router allows this. This will prevent applications like Skype from automatically opening ports.
Also password protect your folders with a strong password for extra protection.
You can also use the schedule power down/up feature to shut the NAS down during hours you are not using it. Also disable Wake On LAN.