Wow the second point, encrypting the files but providing transparent access for a while thereby corrupting even the backups is really scary.
Although maybe this would be detected when your incremental backups start saying that all the files have just changed. Some softwares will require manual action if more than x percent of the corpus needs to be resynched.
I'm saying that a virus that wants only to destroy, instead of get paid, is more dangerous than a virus that wants paid. It's the difference between a kidnapping and a murder.
Do you not remember viruses in the 90s like the ILOVEYOU virus? Plenty of hackers wrote viruses that maliciously destroyed data just because they could.
Although maybe this would be detected when your incremental backups start saying that all the files have just changed. Some softwares will require manual action if more than x percent of the corpus needs to be resynched.