you’re not particularly worried about “someone”, you’re worried about bots that are scanning IP ranges and especially default ports. A lot of people will install a program, not really understand what it does, and forward a port because the setup told them to. Then proceed to never update the program (or it’s a poorly secured program in the first place).
A second device on site is still infinitely more resilient than just letting it rock. Most use cases where a backup would help can be covered by an occasional one way sync or scheduled copy to a USB drive. Offsite is for catastrophes like your home burning down or flooding.