Ransomware encrypts what it can reach. If the backup directory is reachable from the web server process, it is part of the blast radius.
3-2-1 on a small budget
Three copies, two media, one off-site. For a five-euro hosting budget that means the live site, a nightly snapshot on the host, and a weekly pull to object storage somewhere else.