I think a constructive thing for governments to do is to gently push people in that direction. Make high-quality, audited backups a legal requirement, or offer

I think a constructive thing for governments to do is to gently push people in that direction. Make high-quality, audited backups a legal requirement, or offer strong incentives for it, and much of the problem goes away. Companies may be able to outsource it, which arguably just shifts the attack vector elsewhere, but you would hope people who specialise in backups are better at it than their amateur clients.