Sleeper agent malware is a thing especially in high risk situations. If somebody has a dormant RAT installed since year X-1 it’s going to be impossible to solve that in year X by using backups

What about non executable backups? Backup data but not programs?

Not applicable everywhere, but I think it's applicable most places.