Even with port forwarding turned on for the apex, as long as you are not using the default username and password, it would be very hard for a hacker to gain access to that device through the port forward compromise the device enough to gain access to the network and then hack other data.
On top of that they would need a reason to think they would be getting something worth their effort on your network. A Casino is a valid target, a home with an Apex is probably not the best use of their time to hack it.
Port forwarding is not really a bad thing when done correctly (this falls back on that knowledge of networks and routers part of your post). The issue is that most people pick ports that are known open access ports that Hackers target. Picking ports that are normally reserved for things like Firwalls, routers, intrusion detection systems and things like that make it much less likely that a hacker is going to try.
On to Fusion. Fusion is cloud based and uses public and private key authentication to talk to your Apex. What that means is that only Fusion knows what the access key is to talk to your apex. It is not sent through the communication between Fusion and your Apex at all so hacking it is extremely hard. It is further complicated because a client trying to access your apex can only do so by being authenticated to the Fusion servers. It's quite secure and again a Hacker is going to need to have a reason to believe that there is a significant value of what they will get from your network in order to spend the time to try and hack through any of these systems to get to your data.