The old backups are clean, yes. But newer backups (created after infiltration) will be contaminated. Immutable and append-only doesn't help because the files were already contaminated when backed up.

The attacker could: get the victim infested with malware; ensure that the malware infects all new files; wait one year; then trigger the encrypt function.

If the victim pulls a file that is newer than one year old from backup, the victim will pull the malware from backup.

(Only if the file is of a type that could be infected in the first place, of course. README.txt will not be infected.)

Only to the degree that attackers can't figure out a way around them (given months of planning with access to internal systems & documentation).

For instance: I have backups going to an append-only s3 bucket in a separate AWS account, but I don't have monitoring in place to ensure that bucket hasn't been wiped. An email would get generated, but it'd go to the root account holder, who may not notice in time.