Everyone can see that the port 5500 is open on your public IP-Address (your router/firewall). No one can know where it leads to (Roon ARC server running on your NAS). As long as the connected service is secured, and Roon ARC is, then you’re fine. If you don’t trust Roon Labs and Roon ARC then your only option is to not use Roon ARC. Set the port number for ARC in Roon settings to 0 to disable the automatic port forwarding.