The WireGuard-tunnel-to-a-Pi-zero approach works well and is what I'd do — a few practical points from running a similar offsite backup:
Topology
Make the Pi dial out to your home WG server as a peer rather than listening — easier through the relative's NAT, no port forwarding on their router at all.
Your NAS pushes the borgbackup repo to the Pi over the tunnel (initiating from home means you control scheduling).
Initial seed
Right to seed locally: run the first borg init/create at home against the drive (plug the Pi's drive into your LAN once, or first sync during a family visit), then incremental deltas over WG are tiny. Re-seeds over the internet only ever happen if you plan a 'bring the drive home' maintenance visit per year or two.
Security between the networks
WireGuard is the isolation layer: restrict the Pi's AllowedIPs to just the WG subnet so nothing on their LAN can reach you through it, and a compromised device on their network has no path to you beyond that one tunnel endpoint.
Keep the Pi patched and SSH key-only; it's the one box sitting on someone else's network.
Ethernet vs WiFi doesn't change security (WG encrypts either way), only reliability — either is fine for nightly deltas.
Borg specifics
Borg over the tunnel is ideal: dedup means daily deltas are MBs, and borg serve --restrict-to-path on the Pi limits blast radius.
Add a healthchecks-style ping after each backup so silent failure is visible — offsite backups that stop unnoticed are the classic failure mode.
The WireGuard-tunnel-to-a-Pi-zero approach works well and is what I'd do — a few practical points from running a similar offsite backup:
Topology
Initial seed
Security between the networks
Borg specifics