Using wireguard allows me to not expose any ports on the off-site network to the public, as I understand it. The Pi acting as the backup machine is at my parents’ house and if I understand correctly, I would need to open port 22 in my parents’ fritzbox if I chose to not go the VPN route. Dad is very happy I did not have to mess with his network at all 
Though yes, I still haven’t fully figured out wireguard yet and it is another variable. I can’t seem to get the tunnel to automatically update when my Nextcloud-DDNS changes IPs, for example.