The only_dom0.conf file resides in /etc/qubes/backup/only_dom0.conf and its filename owner/group and permissions are the same as in your example.
Now I am just wondering whether the source of the bug I had was:
1/ not having the passphrase_text string within single quotes (’)
2/ not designating the --profile argument as single file name (instead, I always gave the full path with .conf file extension)