Job not running as agent but as engine account
SQL Server itself is performing the backup; therefore the DOMAIN\sqlengine account needs access to the share.

SQL Server Agent is simply starting the job.

This is exactly the same as if you started a backup using the T-SQL BACKUP DATABASE [xyz] TO ... command.  SQL Server would still require access to the destination path.  You can still lock-down the destination path, and should do so, to prevent unauthorized access to the data stored in the backup files.

Also, instead of using Maintenance Plans to perform maintenance, I'd recommend using Ola Hallengren's scripts; they are excellent, well-supported, and widely-used.