Yes, I said "I wouldn't want a backup disk so near the internet", by which I meant there would only be my router's firmware (firewall) between it and the bad guys. And I know nothing about that firmware. Netgear's is a little more public: they have forums and publish lists of changes.

I've read that ransomeware can encrypt attached USB hard drives, hence plugging them into a PC only while taking a backup. But that prevents automatic incremental backups like Windows File History* working. The question is - assuming your backup drive is left plugged into the router and mapped in Windows - will ransomeware see it? I wonder if there's a 'ransomeware simulator' which can test that? If so maybe the use of the mapped drive can be restricted in some way - e.g. to a 'backup user' (which would need Admin privileges). Real ransomeware could of course subvert such a restriction if it were a standard Windows feature, but a home-brew solution might work.

After you found the AT&T modem's USB socket was purely decorative I investigated the one on my BT Smart Hub 2. It does work, but it's only USB2, so very slow, and only provides SMB1 (which is insecure and disabled by default in Win 10 and 11).

I also read about modern Netgear routers. I see their USB drives can be accessed from the internet, though their suggestions of why you might do that seemed a bit fanciful. I would turn that feature off.

*File History is deprecated (hidden) in Windows 11 but still works.