To finish off my move from cron to systemd timers, I had one left which ran as my normal user on my home machine to download the prepared backup file, check it, then delete it from the server. All of this part was done as a normal user, no sudo, and nothing as root.

Set up env, as per https://wiki.archlinux.org/title/Systemd/User 2.1:
“The user instance of systemd does not inherit any of the environment variables set in places like .bashrc etc.”
env > ~/.config/environment.d/.conf
vi ~/.config/environment.d/.conf
Clean up unneeded lines in the above config. If you aren’t sure, it is probably safe to leave it.

Create your service:
vi ~/.config/systemd/user/receivebackups.service
cat ~/.config/systemd/user/receivebackups.service
[Unit]
Description=Run receive WordPress backup script
[Service]
Type=oneshot
ExecStart=/home/marshall/receivebackups.sh

Check crontab to match times (my localtime is America/New_York):
crontab -l
30 03 * * 0 /home/marshall/receivebackups.sh

Create the timer unit:
vi ~/.config/systemd/user/receivebackups.timer
cat ~/.config/systemd/user/receivebackups.timer
[Unit]
Description=Run webbackups script weekly
[Timer]
OnCalendar=Sun *-*-* 08:30:00 UTC
Persistent=true
[Install]
WantedBy=timers.target

Enable and start the timer:
systemctl –user enable receivebackups.timer
systemctl –user start receivebackups.timer
systemctl –user list-timers
NEXT LEFT LAST PASSED UNIT ACTIVATES
Sun 2022-11-06 03:30:00 EST 3 days left Mon 2022-10-31 21:13:11 EDT 2 days ago receivebackups.timer receivebackups.service

Finally, if you intend on the timer running without your user being logged in, follow https://wiki.archlinux.org/title/Systemd/User 2.2:
loginctl enable-linger marshall

And for completeness, I will include my sanitized script:
cat ~/receivebackups.sh
#!/bin/bash
for x in ssh root@server ls /backups/; do
scp root@server:/backups/$x /storage/webbackups
tar ztvf /storage/webbackups/$x > /dev/null &&
ssh root@server rm /backups/$x
done