> Of course if you backup system gets hit then the whole thing falls apart, but you can isolate this one system and it doesn't need to accept any incoming connections.

Unless you need to remote administer it.... But I suppose that's what virtualization helps with.