Short answer: plug the iPhone into a Mac and import with the Photos app or Image Capture, or make a full local backup in Finder. Both put your photos on a disk you control and neither needs iCloud storage.
The part that gets missed is what happens next: those files are now on one disk, and nothing is backing that disk up.
iCloud Photos is not a backup. It is one library, visible from several devices. Delete a photo on the phone and it goes from everywhere, which is exactly what people want right up to the moment it is not. The 30 day Recently Deleted album is the whole safety net.
So there are two separate problems, and paying for more iCloud storage only solves one of them. The first is space. The second is that a synced library and its owner make mistakes together.
The simplest way to get the actual image files onto a disk you own.
Image Capture copies the files and nothing else: no library, no database, just photos and videos in a folder you chose. That is a real advantage. Anything can read a folder of JPEGs and HEICs in ten years, and the same is not obviously true of anybody's library format.
The Photos app does the same import into a managed library, which is nicer to browse and harder to move. Either is fine. Pick the one you will actually keep using.
The trap: if the phone has Optimize iPhone Storage switched on, the full-resolution originals are not on the phone. They are in iCloud, and the phone holds smaller versions. Importing then copies the small ones. Turn it off first, in Settings, your name, iCloud, Photos, and choose Download and Keep Originals, then wait for the phone to pull everything back before you import. It needs the free space to do that, which is its own problem, and it is the reason a lot of people end up with an "archive" of previews.
An import gets the photos. A Finder backup gets nearly everything else: messages, app data, settings, Health data, the layout of your home screen.
Keep that password somewhere that is not the phone. Without it the backup cannot be restored, and Apple cannot help.
The backup lands here:
~/Library/Application Support/MobileSync/Backup/It is a folder of files with hashed names, which you cannot browse in any useful way. It is still a folder, and that matters for what comes next.
Since iOS 13 the Files app can see USB drives and SD cards through a suitable adapter. Open Photos, select what you want, Share, Save to Files, and pick the drive.
It works, and it is genuinely useful on the road. Two things to know. It copies what you selected and nothing more, so it is a manual job you have to remember to repeat. And selecting tens of thousands of photos in the Photos app is a slow and fragile business. Treat this as a way to move a trip's worth of pictures, not as a way to archive a library.
Whichever route you took, stop and count. The photos were on the phone and in iCloud. Now they are also on your Mac, or on one external drive.
Then you free up space on the phone, because that was the point. And often you turn off iCloud Photos, because you did not want to pay for it. The two copies you started with have quietly become one, and that one is a single disk in a single building.
The 3-2-1 rule exists for exactly this: three copies, two kinds of storage, one of them somewhere else. A folder of imported photos on a Mac's internal drive is one copy. So is a Finder backup. So is a single external drive.
This is the step that turns an import into an actual archive, and it is the same step either way: protect the folder those files went into.
~/Pictures.~/Library/Application Support/MobileSync/Backup/.
Reading that folder needs Full Disk Access, which macOS will ask you to grant.Doing it by hand, that is one rsync to a second drive:
rsync -aE ~/Pictures/iPhone/ /Volumes/Archive/iPhone/Note the missing --delete. On a photo archive you almost never want a mirror, because a
mirror propagates a deletion the moment it runs.
Copy Shelter does the same job and adds the parts that get skipped: versions rather than one mirror, encryption before anything leaves the Mac, more than one destination if you want one, and a read-back that checks every piece against the hash it was stored under. It writes to an external drive, a NAS, or a folder in a cloud account you already pay for, so an off-site copy costs nothing extra. It is free for one location, and it is a Mac app: it protects what is on your Mac, including the photos and the iPhone backups you have just put there.
No. Image Capture offers to delete after importing and it is off unless you tick it. The Photos app asks. Nothing removes anything from the phone without being told to.
Optimize iPhone Storage was on, so the phone was holding smaller versions and the originals were in iCloud. Switch to Download and Keep Originals in Settings, iCloud, Photos, let the phone finish pulling them back, then import again.
Yes. An encrypted local backup includes saved passwords, Health data and Wi-Fi settings, and an unencrypted one leaves all of that out. Keep the password somewhere other than the phone, because without it the backup cannot be restored by you or by Apple.
Not directly. Finder writes to a fixed path inside your home folder. The supported way to get it onto another disk is to let it write there and then back that folder up, which is what this page recommends. Moving the folder and replacing it with a symlink is a well known trick and it breaks in confusing ways after macOS updates.
Not on its own. Sync propagates deletions and corruption to every copy, usually within seconds. Most services keep some version history, typically around 30 days, which is a safety net for a recent mistake. A backup keeps versions on a schedule you control and does not remove them because the original went away.
Not today. Copy Shelter is a Mac app, and what it protects is what is on your Mac: your imported photos, your Photos library, and the iPhone backups Finder writes. An iPhone app is planned, and this page will say so when it exists.
Related: backing up a Mac to an external drive, and whether iCloud Drive can hold a backup.