I agree that new institutions that never had pre-internet systems are a harder problem.
> it's unreasonable to expect institutions to build and test paper alternatives just as a backup.
Some type of backup is necessary for anything critically important. From my previous [2]:
In sum, as a matter of policy everything that is officially
categorized as a critical infrastructure must conclusively
show how it can operate in the absence of the Internet.
Depending on a single source for mission critical features has been popular since at least the dot com era. Maybe some people can live with the risk that e.g. Twitter can shut their business down at any time by banning their API key, but some institutions need to be reliable. In the past, this need for reliability lead to the agreement where Intel licensed AMD to second-source[3] the 8086 and other parts.
[3] https://en.wikipedia.org/wiki/Second_source