If one set of credentials can reach prod AND every backup, you have one copy with extra steps.

If one set of credentials can reach prod AND every backup, you have one copy with extra steps.
Same SSH key opens the server and the backup NAS. Same cloud login owns the database and the backup bucket. Same human can delete all of it in one bad afternoon, one phished password, one disgruntled exit.
Backups must live behind a separate trust boundary: different account, different keys, pull-based not push-based, with the backup target unable to be reached from a compromised prod box.
Shared blast radius means shared death. Pull architecture beats push every time. Fight me in the comments.