> “My gut feeling on this is that this is either resolved in hours (they have airgapped backups and can be working as soon as they can spin up new servers)”

What good is having airgapped backups and spinning them up, if they are instantly vulnerable to the same attack again?

It does depend on what the attack is, but how do people approach that scenario?