Without reading TFA how is cloud not off-site backup?
I would think dumping to some kinda S3 write only is more reliable than anything even a medium size company could do.
The last company I worked for we did backblaze for an S3, it couldn't be deleted or updated (versions new files). I fail to see how a company that wasn't quite large could do better on their own. Of course the big risk there is the primary backblaze account getting hacked and the whole thing killed.
Where I worked though they used RAID (mirrored + hot spare) with on system snapshots browsable by employees to handle the primary backup case (idiot deleted something important to them), then an onsite snapshot (daily for 2 months) to cover whatever that would be needed for (never came up, but presumably failure while copying to hot spare).
Then daily with weekly preserved on day 8 off-site (backblaze S3, so cloud) to read only snapshots that also lost some meta data (the system lost extended attributes).
I know it wasn't perfect, but it felt pretty secure to me, and far more secure than any in house solution for the off-site rather than S3 cloud.