The practice developed around the GDPR looks something like this: You keep a separate record of deleted accounts. If you ever need to use or restore from backups, you need to filter the import or other use against that list. You can only do data-integrity checks against the backups and not use it for any purpose, of course. You must notify your local data protection authority if there are any exceptions. Like, if you restored a backup but you can't guarantee that deleted accounts remains deleted.

In other words, you don't need to wipe backups but you can't use them without processes in place to ensure you comply with your customers' rights granted under the GDPR.