The sophistication of the major ransomware attacks happens at the "done" step of your "blast targets with phishing emails/texts, get them to click, done" description. The initial foothold is often done randomly by various attackers, but the execution after that takes some skill and effort and often is done by a limited number somewhat sophisticated groups who buy the initial footholds from a larger number of random attackers. The lateral movement is not generally done through "file shares with fairly wide-open access", but the attackers often (at least in most of the major attacks) manage to obtain full domain administration privileges to the whole network, so if the backups can be easily disabled or destroyed by your administrators, attackers can do the same.

Zero days are indeed often not required, however, IMHO the initial attack is less preventable than that lateral movement and further exploitation - if attackers are in your systems for a week while they spread everywhere and kill your backups preparing to pull the switch to "ransomcrypt" everything at once, then that was your opportunity to detect it and kick them out, but the victim organizations obviously were not capable of that. This needs to be fixed, perhaps by methods similar as you describe.