Eric, thank you for your thoughts on this curious situation. Good suggestions, all.
It's odd, the router responds to login requests from both the WAN and LAN side. For the time being I have enabled the firewall on the router and blocked FTP. Then I enabled FTP on the NAS again, and verified the NAS can't be reached from the outside, but it's accessible to the LAN. Which suits my basic need. It would be "nice" to access the FTP from afar when we're on the road, but not necessary. The WD NAS is actually just a hidden backup for the video on the main NVR.
I like your suggestion to insert another router to act as a real firewall. Nobody's going to dig through two consecutive devices to get at my stuff. We're certainly not a high value target by any means.
We do like to have access to the camera systems from the road, it brings a lot of peace of mind to see everything is OK, and sometimes I see things needing attention before the house watchers do. But having your network remotely accessible sure brings along some security flaws.
Thanks again for your ideas on plugging the leaks!