One way is to install ZeroTier on the two NAS, and use that to set up a VPN between then. Then you can use rsync or ReadyDR for backup (whichever suits your needs best).
Another approach is to use DNS/DDNS, and port forwarding in the two routers. Then you can use either rsync-over-ssh or ReadyDR for the backups.
Both of these approaches have good security. ZeroTier is a bit simpler, but it does require you to trust their cloud service (which manages their VPN).
Point-to-Point VPN between the routers would certainly work. The over-the-internet aspect is secure.
However, the vpn joins the two networks - which might be a security risk in some situations. For instance, if one of the NAS is on an employee's home network, it would result in anyone on the home network having access to the corporate network (and vice-versa). You can put in access controls to limit that access, but it can be complicated to configure.
