If your main computer has had all its files encrypted by ransomware, will the backup NAS know not to replace the good backup with a bad one? i.e. hopefully it's not doing something like `rsync --delete`.
The trick is to make sure nothing has access to the backup storage, which is obviously easier said than done.
#!/bin/bash
cd ~/backups
tar --restrict --keep-old-files -x