If the AWS IAM rules have no overwrite and delete permissions then both admin and ransomware aren't really an issue are they? Obviously putting all your bucket

If the AWS IAM rules have no overwrite and delete permissions then both admin and ransomware aren't really an issue are they? Obviously putting all your buckets on AWS performing correctly is a potential risk by itself, but it's a different kind of risk.