Having gone through this hard journey before, I was surprised to see the alternative to NFSv4 /w encryption (via the traditional Kerberos path ) in Oracle Cloud. Its built into their guest environment agent in their prebacked Linux images and can be added to any other modern Linux. It does the encryption-in-transit via TLS v1.3 and the agent dynamically creates an stunnel upon request to the file system. This is really slick for a number of different reasons including not having to set up or maintain Kerberos for it, but it also means that encryption-in-transit works on NFSv3!
Mount command works the same as before with the exception of the -t argument:
sudo mount -t oci-fss 10.x.x.x:/fs-export-path /mnt/yourmountpoint
I haven't looked to see if there is a non Oracle Cloud implementation of this method by some other open source project or vendor though. I understand that the compatibility is dependent on the backend support which your Synology NAS likely doesn't support. I thought I'd share this for other folks that do enterprise stuff that have been through your pain before. Lots of us are dealing with legacy systems and still need to reach compliance goals to pass regulatory audits.