Immutable Backups It's more difficult to protect local data (compared to cloud data) if there's malware running on the network. If data is exposed as a network share, then there's sufficient access to some of the backup data that can put it at risk.
If you had a data center at your MSP that was going underutilized, then you could look at using Minio. Minio exposes local disk as an S3 Compatible cloud and is accessed through the S3 APIs (as opposed to CIFS), which means access needs to use those APIs. You can run it on Linux or Windows.
if you lock down the Managed Backup agents (recommended) by unchecking Enable Backup Agent and uncheck Allow Data Deletion in Backup Agent from Settings - Global Agent Options you can help prevent someone or some malware from deleting backups. You could also uncheck Allow Edit of Backup Plans
and Allow Edit of Restore Plans in Options to ensure no changes are made to plans. You can also make these changes at the Company level in the management console.
You can assign a Master Password to the agents (from Remote Deploy or by editing an endpoint directly in Remote Management - Edit - Edit Options), if desired - if you need to keep the agents available or so the password is needed should you temporarily enable an agent.
Saving locally is fine, but we always recommend using the public cloud (or Minio at the MSP) as a secondary target for backups.
Immutability is available with the new backup format and is tied to GFS retention settings. Dial in how many backups of each Period (weekly, monthly, yearly) you need and they will be locked down with Object Lock if that feature was enabled when the bucket was created and enabled for the backup plan. Object Lock prevents deletion of the data before the GFS period expires. The key here is not to keep more backup sets than you need to satisfy your customers. Depending on the customers, you may need to adjust GFS settings accordingly. Obviously, the more backup sets you keep, the more storage is needed, but if your customer needs monthly backups for 12 months and yearly backups for 3 years, then that's what they need and you can have that conversation up front to ensure there are no surprises on storage costs as time goes by and storage grows.