Cloud based backup services will help greatly precisely because of because of that.

Also, running your backup script under different dedicated credentials, so that an external backup unit won't be accessible by a standard user. This adds some complexity and has a number of shortcomings, but can help.