They did, they contracted with a vendor to store and backup the data. If that is insufficient then just about every customer of AWS, Azure, GCP, OCP, and every other managed storage provider is guilty of the same sin.

I have to agree with GP here, this is pretty incredible. They contracted with a vendor to store their data, not to back it up. It's not a backup if you can lose it in the same instant you lose the data.

You're right, they are. If your data can't survive a single storage host vanishing from existence, you don't have a backup. If your data can't survive one predictable or regularly occurring catastrophic act of nature, you don't have a backup. If your data can't survive a piece of malware -- with all of the credentials you have -- erasing it, you don't have a backup.

EDIT: Also, if you don't regularly test that your backups actually work, you probably don't have a backup. Lots of companies learn that one the hard way.

Then that is just the 1 in 3-2-1 backups, and neglecting the 3 & 2 is a sin (wrt backup strategies).