Of course, and the same is true of every backup solution. The way to mitigate that problem is with a decent backup rotation scheme:
Rubbish.
A proper backup involves copies that cannot be modified after they are made (i.e. a snapshot after the backup has run if using disk, or for free on tape).
There's nothing special about an rsync/ssh solution that precludes the backup server from creating a read-only copy of each and any backup.