>I am guessing this is normal? My data backups are offline. The idea of making my backups read/write on the internet seems insane.

It's a NAS. Backup isn't the only thing you can do with it. A personal cloud (aka dropbox) is also a valid use case, and requires internet access to work.

For certain notions of "read/write", the risk can be lower. You might make backups to storage, but not have permission to delete files. Or when you delete files, they are kept for a certain safety window (e.g. if you delete a file on June 24, the file is instead moved and can be restored any time before July 24, at which point it is purged).