A backup that an attacker can encrypt or delete is not much protection during ransomware recovery.
Small businesses should therefore maintain backups that are separated from ordinary user access where practical.
The exact architecture depends on the organisation, but the principle is universal: a compromise of the production environment should not automatically destroy every copy of the data.
Backups also need testing.
A backup that has never been restored is an assumption, not a recovery plan.
Ransomware remains a business-continuity problem as much as a security problem.
The goal is not simply to avoid paying a ransom. It is to be able to continue operating without depending on the attacker.