Every business large or small has to have decent backups, in my time working for a MSP I have seen about 10 ransomware infections. You can implement various degrees of protection but at the end of the day backups are the main one. Be it infection, theft, fire etc.
Any company that doesn't have a decent backup may as well just invest their money at the roulette table instead!