If you restore data from backup you're fine. Configuration should be re-applied. Unfortunately you need to check every file with an executable bit that comes out of your backups - review shell scripts, recompile executables.

It's rare that attackers tamper with data, usually they just leak it. Source code may be targeted though.

the risk is lower with data files, but it's not gone.

buffer overflows in non-executable files means it's easy for someone who wants to, to recompromise a machine: pdf, gif, jpg, whatever.