There is a different opinion here:

https://discussions.apple.com/thread/8282686

Not sure what to make of it.

Is it possible to reach the server side of the Time Machine from the Mac itself? Has such a breach been demonstrated?

My Time Machine server doesn’t run an Apple OS. Someone would have to compromise my laptop and then pivot to separately attack my NAS. A state level actor could probably do that. The people running spray-and-pray ransomware ops almost surely couldn’t, or at least wouldn’t bother.

Afaik, my colleague has a setup with regular Apple hardware and software.

According to Darknet Diaries there are gangs that focus on backup server first, because with backups in place ransomware is not as effective. There are examples of backup software companies being compromised to get to their clients.

This is for attacks against bug companies. But maybe it's just a matter of time before "ordinary" ransomware is updated with destroy-backups function.

But to come back to the original question, is there any evidence against Apple Time Machine being secure?