In all fairness, you need more than just off-cloud backups to guard against a single pissed off employee (make sure you're locking S3 and your local backups with different credentials, and the credentials to read the backups can't be gleaned from the credentials that write them) or a single fat-fingered command (kingdomofloathing.com once blew away N days of user progress by accidentally running a backup script in the "restore" direction against prod data).
Of course! Offline backups are only one of the many things that need to be done. S3 versioning can help with fat finger errors, credential management helps with rogue employees, bucket policies can copy files to off to private buckets/glacier, etc...
There is no single perfect solution, so like security you layer your disaster recovery.
> make sure you're locking S3 and your local backups with different credentials, and the credentials to read the backups can't be gleaned from the credentials that write them
This is more or less an exact copy of how I would advise companies to set this up.
I also not advocating against the cloud, just that a single copy in S3 is not a backup solution.