One of the nicer bits of borg is the ability to restrict it to append-only mode, which limits the damage compromised hosts can do. e.g in authorized_keys:

    command="/usr/local/bin/borg serve --append-only --restrict-to-path=/home/backup/bla",restrict ...

I use this with passphrase-free ssh keys to allow automated backups without permitting the destruction of any existing backups.

Do you get enough control do to that on rsync.net?