Is it necessary? You get to make that decision - are you willing to risk loss of the data?
As a matter of fact - by not having a backup - you have already made that decision - you ARE willing to risk losing the data - upgrade away!
Strictly speaking, upgrading the firmware does not require a reformat and should not put your data at risk, however, there is some risk o***litch occuring during the upgrade that could result in your data becoming unavailable.
Similarly - there is always some risk that the unit could fail during every day use, or a virus could infect your system and corrupt your data, or you could have a power outage whilst writing to the unit and end up with corrupt disks or you could delete a file or folder in error.
Your data is at risk NOW, whether or not you upgrade, because you have no backup.
I've upgraded the firmware on my DNS-323 many times, down graded a couple of times also - from 1.02 all the way to the current 1.10b7 beta, and never once lost data because of the upgrade - the decision however (and the risk) remain yours - are you willing to take the chance?
It's easy to say I don't have the money, I don't have the time - look at it from the other angle - what will it cost you in money or time if you lose the data?