if you have configured a static then you have to apply an access-list on the outside interface for allowing which traffic is permitted. now this does not mean that the internal host is vulnerable. only the ports which you have allowed in the access-list are open for that host. the host is by default protected any TCP SYN attack i.e. the number of embroyonic connections. you can limit the number of maximum concurrent connections to that host. also only the valid sequence number and ports are allowed to that host.
if you want explicit inspection for that host then you can turn on ips on the 501.
please do tell if this answers your question.
