You can actually set up app folders in Dropbox so that a particular API key effectively chroots you to that folder. The attacker would only get the backups.
S3's "upload-only" API keys are a solution here: you send the backups into a black hole but the attacker can't delete them.
Looks like Dropbox might not have something like that, giving the attacker read-write access to backups if they can get that API key.
Your master account (or superuser IAM account if you're paranoid) gives you read/write after 2FA login, but you could share your backup creds with the world and never have your backups pulled out or overwritten.
Use S3 lifecycle rules to expire backup objects after x days; data transfer in is free, the operation requests are pennies per thousand, only the bandwidth is expensive (10 cents/GB) to retrieve the backups when you need to perform a restore (even then, still very cheap).
Also, by storing in S3, you can backup and restore from anywhere.
My backup system involves my data storage system reaching out to each machine I want to backup and fetching the data locally.
All I need for that is to put my storage system's public key on the machines, and I'm fine with an attacker getting that.