I'm assuming you're talking about the built-in Time Machine backup system.
When you setup Time Machine backups, you first need to select the external disk used for storing the backups. In the same window, you can checkmark "Encrypt backups". You need to do this to get encrypted backups.
If you do that, you're then prompted for a password to be used for encrypting the external disk. From the password, macOS derives the encryption key using a password-based key derivation function. This means that the weak 5 character password on your user account doesn't come into play here at all.
Had the data just been encrypted with the password as the key, it would be possible to directly brute-force the encryption by attempting each possible password. As you can test millions of passwords per second on a home computer, this makes the encryption relatively weak.
However, Apple does not do that - instead they run the password through a password-based key derivation function known as PBKDF2 in order to obtain the key. The idea is that you store a small amount of random data, called a salt, unencrypted on the external disk for backups. This data is passed along with the entered password to the key-derivation function, which then generates the encryption key.
The trick is now that the key-derivation function intentionally takes a long while to compute - and is constructed in such a way that no shortcuts exists to compute it faster. The salt makes sure that the function cannot be precomputed.
The net effect is that a hacker attempting a brute-force attack is no longer able to test millions of keys per second on a home computer, instead the problem becomes orders of magnitude harder.
To give an idea of the scale: instead of being able to try in the range of 100 million passwords per second on a standard home PC CPU, it is instead only possible to try 20 passwords/sec. Even if you add a dedicated GPU and specialized software, you're only going to be able to test in the range of 50.000 passwords/sec. You can throw more GPUs and power at the problem, but it is still much, much harder.
So to answer your point (1), the password is used as a base for creating the key, but the password is not the key itself. This means that the encryption is not "very weak".
To answer your point (2), the key is not stored solely in the secure enclave. This means that you can access the backup data from other Macs - even if you loose phyiscal access to your MacBook.