Sounds overkill just for backing up files.

Agree on Wireguard. It is faster, more stable and most likely more secured than SSH. And it will work with any application (no per-application configuration required). Without a third party tunneling service, you will need to expose a port in any case (you can setup port-knocking if you want to).