[scarmig]

I think most backup providers (e.g. rsync.net) allow and encourage read-only backups.

The bigger issue is that nowadays organizations have lots of interdependent systems, and if you seize the data of one, you basically cripple the entire organization. So for each system you need to institutionally require both backups and backup testing procedures, which is easier said than done.