How safe do you feel with the NAS company you trust your data with?
No need to throw them out. Better isolation is always the solution.
However what is the practical solution?
I think harden the NAS OS yourself.
In addition to the other answers, noting the change in IP addresses between the two scans, from the rDNS records returned, it looks like you're not actually scanning a host belonging to dewalt, instead you're scanning two different Akamai servers.
Akamai provides traffic management services (e.g. Caching, DoS protection) for a wide range of websites, so ...
Take a look at the IP addresses of dewalt.com in both the cases.
They are different.
So, what's happening is that your default DNS (which is setup for your home connection) is getting a server A that is "shortest distance" away from your device.
When you do it after the VPN connection, your public IP (visible to the rest of the world) is the one ...
Nmap scan report for dewalt.com (22.214.171.124)
Nmap scan report for dewalt.com (126.96.36.199)
Looks like you are scanning different systems here (look at the IP address).
Probably the DNS for the domain is setup in a way to return different IP address depending on where the requests comes from, so that the user gets its "nearest" system for ...