It’s kernel level anticheat, it can do whatever it wants. It’s on the same level as the operating system.
Realistically? Nobody’s gonna bundle Linux filesystem drivers in malware just in case. If someone is to exploit Vanguard for malware I’d expect a credentials stealer to take your Steam and Discord accounts. Ransomware would likely spread to the NAS but that can be mitigated with readonly permissions where appropriate, and backups/shadow copies.