If an attacker who owns your network can also reach your backups, you don't have backups. You have a second target.
For years the backup conversation was about accidents. Disk dies, building floods, someone fat-fingers a delete. Recovery meant restoring from a copy, and that copy being online and reachable was a convenience, not a risk.
Ransomware rewrote the rules. The modern playbook isn't only to encrypt production. It's to find the backups first, delete or encrypt them, and only then trigger the ransom, because a company that can restore doesn't pay. Your recovery plan became the primary thing the attacker comes for.
Which is why "do you have backups" stopped being the question. The real ones are whether a copy exists that cannot be altered or deleted even by someone holding your most powerful credentials. Whether it sits outside the blast radius of the production identity system. Whether you have ever restored from it cleanly, rather than assuming you could.
Immutability and isolation aren't backup features you upgrade to. They're the difference between a backup and a liability that happens to contain your data.
The test is simple, and uncomfortable. If your worst attacker had your most powerful credentials yesterday, would the copy you'd restore from this morning still be there.