It’s a well-known fact that website backups are important for mitigating a plethora of site issues. They can help restore a site after a compromise or even facilitate the investigative process by providing a clean code base to compare the current site state to.
However, if a backup is not set up correctly, it can have the opposite effect — and may instead impose a security threat to your website.
For example, we often find webmasters maintaining old copies of a site within a subdirectory of their main site.
Source: Scuri check