I like to run a bash script to backup my router settings and then rely on HA’s backup mechanism.
My concerns are the separation of script and credentials and not trying to fit bash script into a YAML file. Addons look like a good place as they have a dedicated configuration page.
Is there a minimal add-on template that is suitable for this? (read: it not incur more than 5MB to my backup)
Or is there a way to achieve everything with built-in scripts?
Have you read this?
Alternatively you could probably put an entire shell command in your secrets file.
shell_command:
router_bkup: !secret router_bkup_cmd
Yes, I have read that add-on page long ago, and actually I have developed my own add-ons, but quite bad at it still, fumbling around with dockerfile etc, to the extend that I have forgotten about that simple bash script example. So thanks! 
What should router_bkup_cmd look like? A bash script? I guess my next question is, where should I place the backups? addons give me a dedicated folder named using conventions.