If you use a remote Borg server over SSH, you can set up your authorized_keys file to enforce append-only mode on the server by defining the command to be run a

If you use a remote Borg server over SSH, you can set up your authorized_keys file to enforce append-only mode on the server by defining the command to be run at login, and reject Borg requests by that SSH key which try to purge or remove data. I believe this is roughly what borgbase does to implement their own backup protection features.