I knew about AWS Backup but I previously never saw an option to enable it for S3. It looks like it is in limited (1TB) preview in the Oregon region, and doesn't support backing up buckets encrypted with client-provided keys.
That said, AWS Backup is the answer to ransomware woes and it can't GA soon enough (3P solutions like Rubrik, Druva notwithstanding)
At this point, AWS should offer versioned S3 backups accessible only offline or through customer support, enabled with a click of a button.