That’s why offline backups are useful as a complement. For example, Arq can do backups to an external hard drive.

Tarsnap can be configured so that a special key is needed to delete backups.