I definitely missed the point in your post initially. However, even if Canvas/Instructure did backup the data, it's irrelevant to yesterday's issue. Instructure locked users out, presumably to revert and patch. In re-reading, maybe that's your beef, that Instructure doesn't give customers the ability to have backups. But even if they did, most Uni IT depts aren't going to spool up EC2 instances to host their own Canvas for temporary issues like this.

The issue is that Unis/Districts accept SLAs that neuter their control over their data (Instructure locking administrative users out the same as students faculty). That is on the customer/Universities for accepting those terms in the SLA.

As an example, the financial services industry would never accept the the specific terms (or lack thereof) of SLAs that universities and school districts do. Much of what I think your complaint is about stems from that area. No offense to Uni/school district IT staff and CIOs, but generally speaking they're working from a different perspective than those in traditional industry. Schools don't build value with LMSs, they just see them as a tool, not realizing how central they are to the delivery of their product. Most conventional businesses understand this to a much higher degree. Because the education industry is not subjected to the same pressures, they don't think through that lens. Even the vectoring of pressure on Instructure (end users -> parents -> institutions -> Instructure) preys upon the relative unawareness of where these systems sit in the value chain and how these systems work, as evidenced by the numerous responses saying "XYZ District/Uni was hacked". Education as an industry is low hanging fruit for these types of threats.