You now have hundreds of failure points in the chain. unlimited incremental is often setup with hundreds of points. Versioning is AWESOME with ZFS as well should you ever need to use it.

This has nothing to do with security, but use ZFS, XFS, or ReFS for your repository, even if it's a single box.

Use Windows Defender or another AV, different from your normal AV so an AV failure can't damage your backups.If you HAVE to access it remotely, use a completely different RAT or RMM than you use for your production infrastructure.ONLY have the firewall ports open absolutely necessary for Veeam to function and to administer it.This also means VLAN off your backup box and your backup repository from the rest of the network.This means NO RMM or anything else in relation with your production.Remember the VMWare VMs getting encrypted due to a flaw in the hypervisor? DO NOT run the Veeam VM OR repository on your main infrastructure.Use a unique complex password for the admin account Veeam uses, and have a separate local admin password for administration of the local backup.

DO NOT put the Veeam box on the domain.But holy crap, most people setting it up do not think it through. It doesn't take much to get it to 'work'. Veeam, as a product is massively powerful and flexible. Almost all of this applies to ANY backup product, but is Veeam focused because that's what I wrote it about initially. Just in the last week, I have seen so many recommendations with poor practices this needs to be said again. It's time for my 'no-one knows the pitfalls of running your own backups' post.

Veeam backup 9.5 best practices