If you can completely isolate it so that only management network+ unRAID are reachable, then it's fine.
Outside network is one attack domain, however don't forget that if your PC or other mobile devices on network are infected by virus or malware, they can initiate attack from inside, look at the case of WannaCry in the past.
Not very. I run an enterprise NAS from 2009. Software hasn't been updated since 2012.
As long as you don't exspose it to the interwebs, you're fine.
I have an old ReadyNAS I use for offline backups. Only turn it on to xfer already encrypted folders to it, then turn it off.
You should be able to even unplug the CAT and xfer with usb
It is only as risky as it is attackable.
If you use it internally and segment things so that only your server can reach it, then it is essentially impossible to attack.
Then on the other hand, is your network secure? How easy would it be to get in? Where is the weak point? You have to remember that this is a home. It is not likely to be a large target and generally as long as you have any kind of intelligence you will be fine.
So realistically, you will be fine as long as you don't host it out to the internet in any ways.
You will be fine with just a few simple things to make sure of:
You can update that to v6 that should be safe enough, there are guides online
As long as it is not reachable from any untrusted network like the Internet. It’s as safe as your home network is.
Give it a hardening so that it has a resilient configuration. Allow only internal access from needed devices only. No security updates don’t means that your are affected from the next vulnerability