I think applying these traditional schemes to SaaS environments (now called cloud) can be misleading
When people want off-site backups, the server owner can say they've already taken care of that. I'd say that having a copy under your own control is a separate checkbox we should include!
Also backups in two separate legalizations if the hosting company is not in the same country as you or your company.
Good advice. Though I’d say you can count the cloud storage as 2 copies. They typically replicate the data to three drives, that covers all the typical failure modes you’d normally get when running a drive yourself. Then with a simple click you can even get a replica in another region.
The third backup being in a decoupled system on site is what you now count as your ”offsite” backup. Having this last copy is non-negotiable, no matter how many 9s S3 claim to have.
The usual rule when making backups is that you need 3 copies, one of them offsite. A cloud storage service counts as an offsite copy, but you still need two more, typically one on your computer and one in cold storage (ex: external hard drive).
Treat cloud storage like you treat your hard drive, it can fail at any time. The failure modes are different: mechanical failure vs losing access to your account, but the end result is the same: the system is unreliable and you have to engineer around it.