

I do this except the offline copies are raspberry pis, they grab an update then turn their network card off and go black for about a month. Randomly they turn on the network card, pull a fresh copy and go black again. Safe from randomware and automatic.
I went a little crazy and setup my own wireguard VPN network, all the remote hosts connect to the VPN and the primary server connects to each of them and pushes backups. Because I use btrfs and lots of snapshots I use btrbk, annoying to setup but now my hourly snapshots get pushed everywhere, minimal bandwidth and it flawlessly has worked for years.