There is malware that can infect you simply by opening an office document. One of the cooler security trainings I’ve been through was a recorded demo of it. Opened a doc on one computer, enabled editing, then another computer was able to extract credentials from ram or something.
If you’re fine with self hosting, you can just self host it and backup your local drives to a remote location. That’s what I do.
For backup software, I use Duplicacy. But Veeam, Borg, etc… would work just fine. For images, since they’re just static files and you don’t really need a version history, you could get away with a scheduled rsync job. Though, technically that leaves you more at risk of ransomeware or something that overwrites your data.
For remote storage, I’d first consider a Hetzner storage box since they are flat-rate pricing and pretty dang cheap at $13/mo for 5TB. You might also consider StorJ, B2, S3, etc… I’d just stay away from any lesser known ultra-cheap storage providers.