Object lock support on S3-compatible storage does it for me. That was my only concern with restic, in the event of ransomware and compromised bucket credentials. https://kopia.io/docs/advanced/ransomware-protection/