Under sensible configuration they can be OK. If look at it from vulnerability perspective, most of those devices are running Linux of some sort, so they all are vulnerable, unless updated frequently. A lot of vulnerabilities can be used to create backdoor, so it’s like one more or one less. But if you cut it off from internet and access it only from LAN or VPN, how those vulnerabilities will affect you? If there is opensoyrce firmware for it, like true storage or openwrt, that should cover you from built-in backdoors. I would only question hardware quality.