Yes. Any incoming traffic from the internet that isn't a response to a request from a one of your computers should be suspect. There are many scenarios where your website could be compromised and that could lead to someone having access to the internal network.
Now, the unfortunate reality is that most commercial home routers don't have the capacity to setup a proper DMZ. They may allow you to set a DMZ IP that all external traffic is routed to. This doesn't allow for the separation that a DMZ should provide. To have a functional DMZ, The computers in the DMZ need to be on a different IP range or subnet than the main network and be on a different port on the router that only supports the DMZ IP Range. The end result of a properly configured DMZ is that systems in the DMZ can't access the IPs on the main network directly.
Also make sure that your router doesn't treat the DMZ as internal for the purposes of administration. So it shouldn't trust traffic from the DMZ any more than it trusts traffic from the internet, and you shouldn't be able to get to the administration interface for the router from any systems on the DMZ. This is often the problem with "two router" solutions proposed by others. The outside router still treats the systems in the DMZ as internal and trusted. This outside router could be compromised and all the internal traffic still needs to pass through it to get to the internet.