Whereas I think that isn't a backup at all, because it is plugged into the same machine (i.e. online backup) and therefore going to get crypto-lockered.

A USB drive hooked up via ESATA or USB is directly comparable to an LTO tape.

So is a tape left in the drive.

If you can move a tape to a shelf, you can unplug a USB cable.

And to your question about having a separate machine, a Pi will be fine.

Neither SATA nor USB implies permanence.