Indeed it isn't deleted from backups. And according to [1] it doesn't have to be. In the company I work for it's handled the way that we have a list of subjects (their id in database) who requested deletion and after restoring any backup the subjects' data from the list is deleted again.

[1]: https://www.itgovernance.eu/blog/en/the-gdpr-how-the-right-t...