Story

my guess is that its a better target than windows due to lack of scrutiny - windows gets much attention on the virus/malware front, and thus the likelyhood of it being found sooner (plus heuristics - it only has to look like its mining or being sketchy to get flagged, even if it hasnt been seen or previously identified in the wild.) Perfect example being that nobody noticed anything except slow device speed - this could have gone undetected for years if the hacker were more careful. security through obscurity, right?

theres also a chance they bet that the synology team were not capable of noticing, diagnosing or fixing the malware. many devices these days get rare-to-nil firmware updates, even fewer people ensure they are actually applied, and its a beautiful hole to your internal network for other uses.