Untill you test a backup it's not complete, how you test it is up to you.
If you upload to a remote location, pull it down and unpack it. Check that you can open import files, if you can't open it then the backup is not worth the dick space
I would prefer, why 2fa everywhere is important. But not SMS!
If you have 2fa on accounts, your password is only 1 bit of the login. Passkeys or yubikeys will stop most login attempts dead, you can't send them to anyone.
But yes unique passwords also help, as that 1 service is the only thing with that password.
I migrated from KeePass2 as the the DB would get out of sync and need to be merged back together. Thats why I moved to Vaultwarden, I like having my data on my own stuff
I second Vaultwarden, have been running it for a few years and even had a catastrophic host failure that I recovered from. was able to use the clients on both phone and laptop while building new host
There is a backup image you can run to take backups of the SQLite DB, used that a few times as the DB got tangled.
Also anything you host should have a good 3-2-1 backup strategy
That very much depends on your backup of choice, that's also the point. How do you recover your backup?
Start with a manual recover a backup and unpack it, check import files open. Write down all the steps you did, how do you automate them.