Messages

As far as I know, the CARP VIP does not necessarily need to be within the same subnet as the interface addresses.

With this setup as it is, the backup node will have no internet access, e.g. for updates.
To enable internet you have to route its upstream traffic over the master node.

You are absolutely correct in your assessment. A CARP virtual IP address (vIP) can indeed be located on a different subnet, but this configuration creates specific routing issues for the backup node.