Is corporate IT negligent where it appears to have no disaster recovery plan?

Arguably, yes. Merck isn't a small time start-up. They've been on the Fortune 500 list for 60+ years. They can afford whatever layers of backup and redundancy they need.

Does anybody have offline backups anymore?

Previous gigs, for large ISPs and related orgs, did. This was on a team-by-team basis, though.