It would be a great destination for cloud backup, where one of the concerns is loss of all your backed up data due to malicious action - look at the trouble the hackers had to go to in Mr Robot to take out their offsite tape backups. I'd be more concerned though with the durability of the company rather than their disk systems over the long term though.

Separate AWS account with write-only permission to backup S3 objects from production pushed out to the backup account. Enable versioning and glacier in backup account. Lock down backup account credentials appropriately. (And add alerting and periodic fire drills of course.)

Amazon is still a single point of failure when you backup S3 to S3.

What if they deploy a silent corruption bug next year?

Also you can change your s3 bucket to enable multi-factor delete, which essentially makes it immutable unless you delete using a 2fa device, which shouldn't really happen accidently.

There would be still a lot of tooling needed around just lambda like serverless compute layer.