It is; just move to the cloud.

AWS S3 and Google Cloud Storage have Retention Policy Locks [1] and fuse bits in their buckets. e.g. set the retention policy on your backups bucket to 1 year and burn the fuse bit.

Now files cannot be deleted or changed in that bucket for 1 year after their creation. Not even the account root owner contacting support can get it changed. No ransomware, short of breaking into the AWS or GCP control plane is going to compromise those backups.

1. https://cloud.google.com/storage/docs/bucket-lock#policy-loc...

P.S. remember the write protect tab on old floppies/tapes ;)