A single vendor to handle the primary storage and all backups is insufficient for your most critical data.

But where are you seeing this vendor was tasked with backups? This looks like a single copy situation.