The first two copies share your fate.
Your local backup and your NAS live in the same building, on the same network, behind the same login. Whatever gets your data — ransomware, fire, theft, a fat-fingered delete that syncs everywhere — usually gets them too.
Folder3 lives somewhere else entirely: offsite, immutable, and air-gapped from your credentials. When copies one and two go down together, the third one is the reason it's an incident report, not a resignation letter.