I think a big part of the issue is that backup processes are designed for a small number of machines failing. The the IT department restores data from backup, and manually adjusts the config and software till stuff is working.

That process works well till ransomware comes in and destroys every server and client machine at once, and suddenly you've just given the IT department multiple years worth of work to all do at an emergency pace.