Someone who is storing disks offsite is unlikely to have only one copy. I'd offer to review his backup strategy with him, but other than that, I'm "dumb storage", how my friend uses it is his business. I'd also make clear what expectations are if law enforcement or someone with a gun comes for the disk (they're getting it, that's what the encryption is for and I'm not going to jail/dying for something that should be solved with replication).

Then it’ll either work or not, but spending any time worrying about what might -with some infinitisemally small chance- happen seems pointless.

Just use LUKS or FileVault full disk encryption. Your friend just has to memorize one password. If it gets stolen, it's as good to a thieve as random data.

Same if the disk gets corrupted because we didn’t realize it’s stored next to the fan, and 2 years were enough to have an impact.

I would tell them to make more than one off-site copy. It's their responsibility to not just depend on you.

Also the thief doesn't need to be the one dealing with the data, the same way people stealing cars are usually not the ones brokering them, and brute forcing an offline password wouldn't be crazy long considering it's supposed to be memorable (possibly by more than one person)

Just to say, spreading backup hard disks here and there, and assume everything will be fine even if some of them get lost in the wild feels like a pretty laid back attitude in contrast to the length spent on having a fully functional 2FA system.

Of course, you're open to the risk of loss in a bank robbery, but how often do those happen anyway?

Huh how would that shorten the lifespan of any storage device?