They already do, I worked a case last week where that happened. Trickbot for example will be on a machine for 2-5 months so that it's in your backups, and is c

They already do, I worked a case last week where that happened. Trickbot for example will be on a machine for 2-5 months so that it's in your backups, and is commonly followed by Ryuk ransomware. So if you get hit with Ryuk and just restore from backups without re-mediating anything you will likely be hit with Ryuk again.