As curiousdannii notes above, rsync is released under GPLv3, so the distributor has source distribution obligations. Unfortunately, those obligations are principally to the licensors, these being the rightsholders in the original code.
So first of all, as noted, you should look on the manufacturer's website. Many companies take their free-software obligations seriously, and those will generally already have the software up for you - somewhere. I wrote a whole article on Intel's partnership with Software Heritage, intended specifically to ensure long-term availability of any source code that they had an obligation to distribute. Most such companies aren't as good at publicising source availability as I would like, but they do generally understand their obligations, and make an honest attempt to fulfil them.
Unfortunately, the history of copyleft software is also littered with examples of nasty little companies that popped up out of the ground, took a bunch of GPL code and adapted it to suit, embedded it in their product, then ignored their consequent obligations. There has been some success in dragging these into court, both in terms of mandated compliance, and in terms of damages awarded. Unfortunately the availability of court orders to require source release (referred to as specific performance in another article of mine) is a function of jurisdiction, which is why so many of the more-successful actions have been in Germany, and the wider EU). Other court systems tend to view everything in terms of compensatory damages, which is not what you want, and very likely not what the rightsholder wants.
The same article also discusses third-party rights, which relate to your standing to sue for the performance of the NAS maker's obligations to the rightsholder, and again, these are generally most available in civil-law jurisdictions such as much of the EU.
Organisations like Software Freedom Conservancy exist to shepherd violators back onto the path of compliance (though they use the dogs less often than I would like). Sadly, rsync is not one of SFC's current projects, but if this question had been about, say, SaMBa, then a letter from them can be much more effective than one from you or me.
It's likely worth asking on the project mailing list. Search the archives first, and see if you can get a measure of how much they appreciate violation reports on-list, but a big project may well have a standard template letter they're prepared to send to a violator. Since they represent the rightsholders, the NAS maker will know that ignoring that request is much more dangerous than ignoring yours.
The source might already be available, so look first. Use of the more sophisticated controls on your search-engine-of-choice can be very helpful, here.
If it's really not available, do by all means ask. It's likely to be most effective if you don't go in all guns blazing, but respectfully and as a supplicant, even though you have a complete right to this source.
They are obliged to give you the source, but the obligation isn't to you, so getting all lawyered-up, even if you can afford it, may not be very effective.
Look for community organisations who might be prepared to help, and see if the original authors are set up for it.