3-2-1 rule.
I would use time machine capsule and periodically (weekly?) connect an encrypted external drive and Borg backup there. Next week a second drive, third week the first one...
Always keep one of this drive off-site.
This is just one of many options how to get reasonably safe (I use an almost this one just deja-dup instead of time machine.)