I remembered wrong. I’m fairly certain that Synology, at some point, allowed you to store the encryption vault on an external (USB) drive, but apparently not anymore.

You didn't remember wrong, I have mine stored on an external drive. I am using DS 6.x though