Let’s call it second defense line. Most costumers get equiped with a cheap router by the internet supplier. There always is a chance for a security issue.
Another reason might be this: Most router types do not support a lookup table of country specified IPs. The Synology DSM does. It know where the IP origin is that wants to gain access to the NAS. As you know there are several countries well-known for hacker attacks. I surely can see on my firewall logs what country those are from…