Comment by sdave

1st level of protection is by keeping your live production data & backup data in separate accounts.

(If 1 account gets compromised the other is still available)

Perhaps 2nd level is by using cloud specific features - such as AWS S3 Object locks (even owner can't delete the object till the retention period).

my 2cents