My Time Machine server doesn’t run an Apple OS. Someone would have to compromise my laptop and then pivot to separately attack my NAS. A state level actor could probably do that. The people running spray-and-pray ransomware ops almost surely couldn’t, or at least wouldn’t bother.
According to Darknet Diaries there are gangs that focus on backup server first, because with backups in place ransomware is not as effective. There are examples of backup software companies being compromised to get to their clients.
This is for attacks against bug companies. But maybe it's just a matter of time before "ordinary" ransomware is updated with destroy-backups function.
