You can write backups to an NFS share, and create regular snapshots on the file system server that are not writable from the outside (you have to log into the f

You can write backups to an NFS share, and create regular snapshots on the file system server that are not writable from the outside (you have to log into the file system server, which hopefully is extra secured / limited access, and has a different OS than what you use elsewhere). It's not perfect, but at least a single vulnerable client can't encrypt or delete your backups (in the snapshots) that way. As usually with security, the principles of least privs and segregating as much as possible are important.