The act of port forwarding itself is unlikely to be a major security issue. Risks would come from the fact that the BitTorrent protocol is very complex, and libraries for it are necessarily complex. Any time you have code parsing complex attacker-controlled data structures, you are risking exploitation.
Using a sandbox
Hardening a torrent client can be done using various forms of sandboxing. Different operating systems have different techniques for this, such as AppArmor on Linux systems, Seatbelt on OSX, and AppLocker on Windows. These are all frameworks for limiting the capabilities of individual programs, called Mandatory Access Controls, or MACs. A confined program is called a subject, and resources it wishes to access are called objects. A subject can be restricted to only accessing certain objects (and even then, performing only limited operations on said objects), or objects can be marked as accessible by only certain subjects. This general technique is useful to prevent a compromised application from doing much harm.
Using a seedbox
Another, more complete, solution is to use a seedbox. A seedbox is a remote server running a torrent client. Torrents to be downloaded are uploaded to the server, and when they are completed, they can be downloaded through a direct connection (often http, ftp, sftp, or rsync). Seedboxes provide the ability to continue seeding and leeching even while your computer is off or your network is down, and are not limited by the bandwidth caps imposed by your ISP. However in this case, they also provide the additional benefit of isolating any compromise of the torrent client to the seedbox itself.
Keeping backups
Having all your data on a NAS does open up the risk of ransomware. It is unlikely that an attacker who just wants to distribute such malware would burn a 0day on a fully up to date torrent client. Such attacks are far more advanced. In order to reduce the risk of ransomware in general, though, you should keep most important backups on offline storage. This is important not only to avoid ransomware, but also catastrophic filesystem corruption (which even RAID would not protect against). You should use the 3-2-1 backup rule. This states that you should keep 3 copies of any data you do not want to lose, 2 on different types of storage media, and 1 offsite.
