I use rsync.net for borg backups. They create daily ZFS snapshots that are read-only to the user, specifically for ransomware protection.

But this was a good reminder I should probably figure out some good way to monitor my borg repo for unintended changes. Having snapshots to roll back to is only useful if a problem is detected in time.