They all look good to me, one more way would be using MFA delete to protect your data.
You can lock root out of that as well but as root user, you have permissions to delete bucket policies. So, you delete existing one and put a new one back.
EFS Deletion protectionAccepted Answerasked 5 months ago
Veeam backup to S3 and deletion protectionAccepted Answerasked 2 years ago
Calculating LIST, GET, SELECT requests to/from S3asked 9 months ago
Audit of S3 Bucket Deletionasked a year ago
What will happen when API call to get a object from S3 which is in S3 infrequent storage or in Glacier ?asked 7 months ago
S3 content protection and deletion methodsAccepted Answerasked 2 years ago
How to disable deletion protection?asked 4 years ago
Glacier Early Deletion fee applied to date Tape was Created or was ArchivedAccepted Answerasked 3 years ago
S3 Object locking and eventual consistency?asked 3 years ago
Object deletion from a non version bucketAccepted Answerasked 3 months ago