Right now when updates get applied to the NAS, if it gets powered off during the update window that would be really bad and inconvenient require manual intervention.

You sure? I mean, sure, it's possible; there are devices out there that can't deal with power loss during update. But others can: they'll typically have space for two firmware versions, write out the new version into the inactive slot, and only when the new version is committed to persistent storage, atomically activate it.

Last device I worked on functioned that way.

you might lose data in flight if you’re not careful.

That's the responsibility of the application if they rely on the data to be persistent at some point; they need to be written to deal with the fact that there may be in-flight data that doesn't make it to the disk if they intend to take other actions that depend on that fact; they'll need to call fsync() or whatever their OS has if they expect the data to be on-drive.

Normally, there will always a period where some data being written out is partial: the write() could complete after handing the data off to the OS's buffer cache. The local drive could complete because data's in its cache. The app could perform multiple write() calls, and the first could have completed without the second. With a NAS, the window might be a little bit longer than it otherwise would be, but something like a DBMS will do the fsync(); at any point, it'd be hypothetically possible for the OS to crash or power loss or something to happen.

The real problem, that I need an nas for, is not the loss of some data, it’s when the storms hit and there’s flooding, the power can go up and down and cycle quite rapidly. And that’s really bad for sensitive hardware like hard disks. So I want the NAS to shut off when the power starts getting bad, and not turn on for a really long time but still turn on automatically when things stabilize

Like I said in the above comment, you'll get that even without a clean shutdown; you'll actually get a bit more time if you don't do a clean shutdown.

Because this device runs a bunch of VMs and containers

Ah, okay, it's not just a file server? Fair enough -- then that brings the case #2 back up again, which I didn't expect to apply to the NAS itself.