why the backups being reachable from the same compromised environment. if the backup system accepts deletes with the same creds that run production, it is replication, not backups.