Keep attackers away from the recovery path
Attackers frequently target accessible backups before encrypting production systems. Separate credentials, restricted administration, immutable or isolated copies, and alerting reduce the chance that the same compromise destroys both systems and recovery data.