I think it depends on what threat you are trying to protect against. But anyway, on Windows it should probably by ransomware these days. My thoughts below apply to other malware as well.
Keeping your files on a NAS accessible via Windows file sharing (SMB) is not much different and not much more secure than a local disk. Encryption of the disk does not help if it's mounted all the time anyway.
The problem with protecting against ransomware (and part of the reason it's so successful) is that if you can automate backups (the backup drive can be mounted automatically), the malware can also mount and access it, and recent ransomware quite possibly will do that. Even if it needs a password from you, the ransomware can (in theory at least) sit in the background until you type that password once, and then it can access your drive anytime.
So you should have offline backups, where offline means really offline, as in the NAS switched off or something like that. Backups on write-once media could also be an option, but not very feasible, especially not for home use.
So I think it comes down to a reasonably secure backup strategy, and what exactly is reasonably secure for you depends on your scenario. For example you may want to make a truly offline backup (by physically switching on a NAS, making the backup and then switching it off) once a week, and a daily backup to a password protected drive that is not always mounted. Obviously this is just one example, several conflicting factors need to be balanced (convenience, importance of your data, what timespan of data you can afford to lose, etc).
In short and as always, it's about cost and benefit. Your defense should be proportionate to your risk.