Nothing says we need to mimic all the ways things are done in Windows just because. Let's say you already have regular zfs snapshots of your workstation, that

Nothing says we need to mimic all the ways things are done in Windows just because. Let's say you already have regular zfs snapshots of your workstation, that get synced to one of your servers using something like syncoid or zfs-repl. Then you could have a service that runs e.g. a daily scan of the most recent snapshot. Or regular scans of newly modified files, with a less frequent full filesystem scan locally. The upside of Linux is that you can tailor it to your needs.