Why won’t local backups be sufficient against ransomware? Is it because of privilege escalation attacks?

I was under impression that even with zero days, using modern distribution and auto updates will minimize the amount of time the system is vulnerable, so for most of time, it will be sufficient.