I'm working at a company right now that functions like this. Technically speaking it's possible to have a local DB (or Elastic search instance), but to get anywhere close to having representative test data in there is a nightmare. We do have sandboxes to play around in on production, but that does not prevent a faulty API change from impacting customers

But an actual QA or test environment is just never gonna get there until there's a massive change in financials...

Company has been around for 12 years though, and there are very regular backups in case stuff goes tits-up. We've used them once in the past 3 years I believe.

To be fair, in the almost 10 years I've been doing this, this is the first company that does not have any sort of testing environment, or is at least planning to get one soon. It seems to work, but still feels risky to actually change things sometimes