If you prefer paper backups (encrypted with a QR Code), the easiest and most secure way for you is to import a wallet with an existing recovery seed (created outside of Bitcoin Core, obviously) via descriptors, extracting the BIP32 root key (which is what I did in my case).

But even so, you might prefer to encrypt the descriptors extracted from Core using gpg/aes, and then convert them into a Qr Code format. It would be an interesting experiment to follow.

I'll tell you what I would do in my case:

Let's assume I created a native wallet in Core. I'll encrypt it with my password/passphrase before transferring funds, obviously. For me, just backing up the wallet.dat file is enough, but to prevent snoopers from accessing my wallet.dat and seeing the balance and transactions but not being able to spend, I'll add additional encryption, perhaps using gpg or aes, or perhaps something simpler like moving the file to a Veracrypt container or (even easier) to a KeePass database file.

This would make a great topic (about additional encryption in the core).

I wouldn't make any physical backups, at least for now.