ZFS it

What are the vulnerabilities that you’re afraid of? Can you answer this purely from the info OP gave, i.e. without making assumptions about what the server authorizes the phone to do? OP’s post does not indicate that they’re violating the principle of least privilege in any way.

Scheduled snapshots (btrfs or zfs). If the compromised account deletes or modifies files, they’re still there in the past snapshots

Filesystem-level snapshots are quite space-efficient because they don’t make copies of all the files or even whole files; just the blocks that changed.