Paying your web host for regular data backups of your server is like paying for insurance.
It’s only expensive until you need it.
Which is why I just quoted someone $25K to recover their malware infected web app server.
Because taking off and nuking the site from orbit with a known good backup is no longer an option.
It will entail weeks of painstaking work of picking through the rubble looking for things that shouldn’t be there.