The back-up procedure is usually written with systems breaking in mind, not a malicious actor trying to wreak havock.

A lot of times the back-ups machines are always connected (or easily discovered since they’re always online) which allows an attacker to remove the back-ups too.