Expanding on heavyd's comment: a ransomware attack is likely to hit your client computer first (via drive-by download or something similar), and from there it can potentially encrypt anything the client computer has access to, including the NAS. Your first line of protection here is access controls: requiring a password to mount the NAS, and setting permissions so that even after it's mounted you don't have access to anything you don't need. But there's a limit to what this can do, because malware might wait for you to mount the NAS, then use your connection to access & encrypt your files on the NAS. If the malware is running on your computer, then its access is equal to yours.
If you have data you don't want to lose to ransomware, there's one clear best solution: an offline backup. Offline, so the ransomware can't get at it. And since the backup has to be online to be updated, you really need at lest two backups, at least one of which is offline at any time. This is a really good idea in any case; ransomware is just one of the many kinds of data disasters that can happen, and a good backup system will protect against other disasters as well.