I am also going to recommend the same solution as @matcha_addict@lemy.lol in this comment: https://lemmy.ml/comment/7998407

You can create a key pair that is specifically just for this kind of backup transaction.

To limit its affects, create a user and group on each of the devices that are highly restricted.

This is actually the most secure solution that doesn’t require an interactive password prompt. The passwordless key only serves this one purpose and has small attack surface.

Basically, you can tell SSH to allow root login on certain devices by setting up a root key pair. You configure SSH on the target device such that when it logs in, the login must run a script or a single command instead of running a shell, this limits what attackers can do if they somehow steal your private keys. You can also keep these private keys in your SSH agent so you only have to enter their passwords once, this will allow you to run remote commands without a password.

I would recommend also exploring the possibility of setting up an Rsync Daemon on each remote device, it keeps an Rsync process running on a remote device and listens for connections from Rsync clients. https://linuxconfig.org/how-to-setup-the-rsync-daemon-on-linux

On an unrelated topic: you might also want to look into using Btrfs and making and transferring snapshots to other devices.