I don't know. Intuitively I would have thought that a NAS that updates itself automatically, with SMB1 disabled, is less dangerous that a NAS that is in theory insulated from the internet but not patched for security vulnerabilities (since not connected) and connected to machines that are on the internet and could be infected.

I am not sure what “a physically separate network” means when it is used by the same computer. (Also, what about accessing your storage over WiFi? Or, you have to have cables strewn all over the place?)

For a lot of "pro" usage scenarios, the local environment will have one "LAN" that has Internet gateway, and various local services on it, plus a dedicated storage network using a separate switching infrastructure (and thus, separate NIC port on your machine).

WiFi is not really an option, for performance but also often for security reasons.

So yes, you'll have two cables from wall-jacks to the machine for networking.

> you have to have cables strewn all over the place?

Of course. WiFi isn't going to work in shared user environments that chew bandwidth for breakfast.

Not having to worry about the security issues of WiFi too can be helpful (depending on your security requirements).