As a government you should not be putting your stuff in an environment under control of some other nation, period. That is a completely different issue and does not really relate to making backups.
I would say another main issue is that while they ask you to setup DKIM records, they do not actually DKIM-sign your emails. Hence your mails may be more easily flagged as spam. Several people have reported this to Apple, but AFAIK it still hasn’t been fixed.
As a small developer, you wouldn't fall under the DMA.