Short answer: if your backup is a mirror, it will faithfully replace every good file with its encrypted version the next time it runs, and it will do that without being asked.
Versions are the whole defense. Not a better disk, not a faster copy: keeping yesterday as well as today.
A mirror keeps the destination identical to the source. That is its stated job and it does it well. The line most people run is some form of:
rsync -aE --delete ~/Documents/ /Volumes/Backup/Documents/Read --delete again with a bad morning in mind. It means: make the backup match, and
remove anything from the backup that is no longer at the source.
Now suppose something has encrypted your Documents folder overnight. Every file is still there, same names, same folder structure, different contents. The mirror runs at its usual hour, sees files whose contents have changed, and copies the new contents over the old ones. It has done exactly what you told it to. Your backup is now a second copy of the damage.
Drop --delete and it is not much better: the deletions stop propagating, but changed
files are still overwritten, because a mirror holds exactly one version of each file.
This is not a Terminal problem. It is a property of anything that keeps one copy.
The common thread is that none of them is doing anything wrong. They are all correctly propagating a change nobody wanted.
A versioned backup stores what a file was on Monday as well as what it is on Friday. When Friday's copy turns out to be worthless, Monday's is still there.
Two things make that useful:
The 3-2-1 rule was written for hardware failure and it happens to answer this too: three copies, two kinds of storage, one somewhere else. What matters here is the last part, and specifically a copy that is not permanently attached.
A drive plugged in all week is reachable by anything running on the Mac all week. A drive plugged in on Sundays is reachable for a few hours a week. That is not sophisticated and it is most of the practical benefit, which is why the boring advice about rotating two drives keeps being right.
Worth being plain, because this is where the category oversells itself.
A backup does not stop anything happening. It does not detect the thing as it starts, it does not block a process from writing to your files, and it is not a substitute for keeping macOS updated and not running things you do not trust. Anything sold to you as protection in this area is doing a different job from the one described on this page.
What a backup does is make the damage undoable. That is a smaller claim and a more useful one.
Copy Shelter keeps versions, so a file changing does not overwrite what it was, and deleting a file on your Mac does not remove it from the backup. It reads the backup back and checks every piece against the hash it was stored under, so a copy that has quietly become unreadable is reported. It writes to more than one destination if you want, and it counts only the copies it has actually verified.
It does not prevent anything, and it does not detect anything as it happens. It gives you history, and history is the part that gets you back to Monday.
Better than a mirror, because it keeps history: hourly for a day, daily for a month, weekly while there is room. Two caveats. It thins old snapshots as the disk fills, so depth is whatever the disk allows. And a drive attached permanently is reachable permanently.
Only if what you put there is a versioned backup. A synced copy of your live files will not do it. A sync folder propagates the change. A backup repository written into that same folder does not, because the old versions are separate objects that nothing at the source can reach.
Longer than you would expect to notice. Thirty days covers a mistake you see immediately. A year covers the folder you have not opened since last spring, which is the one that catches people.
No, and nothing that calls itself a backup should tell you otherwise. It keeps versions and verifies them, so the damage is undoable. Preventing it is the job of keeping macOS updated, not installing things you do not trust, and not being the person who runs the attachment.
A second drive you plug in once a week, keep somewhere else, and never leave attached is not overkill and costs about the price of a takeaway. It is the single most effective thing on this page.
Related: the 3-2-1 rule, backing up with rsync, and checking a backup is readable.