I think this came from my misunderstanding in how rsync works. If I understand correctly, rsync traffic is never and can't be encrypted. Rsync over ssh isn't truly connecting an rsync client to module but rather an rsync client obfuscation that logs in and transfers files purely over ssh, no rsync server on the remote required. That would mean you can either have an rsync server to connect to with an rsync password, or you can connect to the remote directly over ssh with a public key authentication, not both.
On synology, only admin users can use ssh (stupid rule, i know), so I'm just going to use a standard rsync module.