This isn't "our backups need to be WORM."

This is "there are no backups."

Anticipate a problem with your IT staff leaving the write-enable switch on? Have the drive maker add a (again, physical) clock circuit (could just be an RC delay) to turn it off again automatically.

(Even if you don't anticipate a problem with your IT staff, it's just good engineering to automatically turn off the write-enable. Nobody's perfect. I've gone to the airport without my passport once. It really sux when you do that.)

This is a system I put together at my first IT job.

Backups get pushed from devices between 1AM and 3AM each day, so the primary backup server enables it's network card at 1 and disables it at 3.

Primary backup server also has a second network card, that in turn is attached to a small subnet containing it and the secondary backup server only. The secondary backup server pulls a copy from the primary on a weekly basis in a similar manner as the primary, disabling it's network card once it has finished.

Maybe they can hit the primary if the infection takes place overnight, but the odds of getting the secondary are pretty low.

The odds of hitting the secondary are zero if you've got a hardware write enable switch!

One thing you could do is get one of those mechanical lamp timer clocks from the hardware store, and have it turn the power on/off the network card on schedule.

I am now seeing a grandma style light timer device used to turn off and on a cheep switch.

Oh you could find an expensive way to do it, but the idea is the same.