The 3-2-1 rule is old — it predates digital photography — and it's still the clearest answer to "how many backups do I actually need?" For anyone shooting something that can't be redone, it's not optional.
What 3-2-1 actually means
Why "two folders on one drive" doesn't count
A single drive is a single point of failure. If it dies, both "copies" die with it — which is why the rule specifically calls for different media: two separate physical drives, or a drive plus a NAS, or a drive plus cloud storage. The failure mode you're protecting against is the drive itself, not just an accidental delete.
Why one copy has to leave the building
Two drives sitting next to each other on the same desk both burn in the same fire, get stolen in the same break-in, or get hit by the same power surge. "Offsite" doesn't have to mean a data center — a drive at a second location, or a cloud sync, satisfies the rule. The point is that no single event should be able to take out every copy at once.
Where the card fits into this
Technically, the card in your camera is copy number one — but it's the copy you're about to erase and reuse, so it barely counts. The moment that matters is right after a shoot: don't reformat a card until at least two of your three copies exist and have been verified, not just "copied." A copy you haven't verified is a guess, not a backup.
One detail ShotGrab handles for you: it copies to more than one destination automatically as part of a single cascade — verifying the primary copy first, then verifying each secondary against it — and frees the card the moment the fast drive is done, without waiting for the slower ones. That gets you to "two copies on two different drives" the instant the card comes out of the reader, instead of as a separate step you have to remember to do later.