I think a good way to go would be to get an used desktop and backup your VMs to it using rsync. "Pure sync is not backup", yes, that's right. So for a real backup you can use a service like Wasabi, for example, which will cost you around $5/TB per month with no extras fees for data transfers.
In case you lose any VMs, you could immediately access a local copy at your used desktop. In case your whole place/office is compromised, you could access Wasabi from a different location and download a copy of your VM.
If you're running a spare desktop with some disks in it, just run ZFS on that, take snapshots after every rsync, and ideally initiate rsync from the backup machine and don't have credentials to it anywhere else so that it can't (easily) be compromised at the same time as the other systems in the event of malware.
Though yes, you should also always have an offsite backup as well, which AFAIK wasabi is fine for (as long as you're aware of the 1TB/90d minimums).
In case you lose any VMs, you could immediately access a local copy at your used desktop. In case your whole place/office is compromised, you could access Wasabi from a different location and download a copy of your VM.
Disclaimer: I'm a Wasabi MSP.