An alarm or quota on disk IO volume could mitigate this.
Since the NAS is the center of my important data, I pay attention to it more.
-----------
A business solution would probably need an alarm of some kind, because a busy IT professional isn't going to have the time to baby a machine like I do.
Its just the whole "computers are cattle in professional IT settings" but are "pets for the home user".
The attack happens on a file-by-file basis, within the free space that you have allocated on the live filesystem. foo.txt, bar.pdf, and baz.jpg are all encrypted in place, consuming only marginal free space during the operation.
Then, when the incremental backup happens, THAT will notice that ALL the non-OS files have changed and the backup consumption will explode.
Done and done. Additional storage is only taken if a file changes. You can always use a snapshot to revert to an earlier version of the filesystem (in the case of a malware attack).
Actual backups of the NASBox do happen of course, should the case fall over and all the hard-drives get scratched simultaneously.