One could fairly argue that maybe such people shouldn’t have access to a system, but it is a reality.

More that, such people shouldn’t be allowed to be sysadmins, yet self-host and/or expose any ports to the internet.

What you’re talking about is basically an encrypted backup. Seedvault does exactly that, it’s included in many custom ROMs, including GrapheneOS.