Should the backup system have separate admin accounts?
Yes. If the same domain administrator account that runs everything else can also delete backups, then an attacker who steals that one account controls both your systems and your way back. Give the backup system its own administrator accounts that are not members of the main domain or directory, protect them with multi-factor authentication, preferably phishing-resistant, and use them only from a dedicated management workstation. Service accounts that the backup software uses to read data from servers should have only the rights they need, and their passwords should be long, unique and stored safely. Where the backup product supports it, require a second person to approve deleting backups or shortening retention, often called four-eyes approval. Review who has backup admin rights at least twice a year and whenever someone leaves. These steps cost little and close one of the gaps ransomware attackers exploit most often.