I've hacked my own Synology through it's "cloud services" setup, to the point where I uploaded a privlege escalation exploit (for the really old kernel). It was frighteningly easy, so now it's firewalled off on my local network :(
If they don't, they're almost criminally negligent, so you wouldn't want to buy from them anyway.