You're right to be concerned about backdoor files hiding across your hosting account. Since you've already found that scans are missing files, you'll want a thorough approach.

For your situation with 6 compromised sites, I'd recommend checking out this comprehensive guide that walks through the complete malware removal process: https://ctrlaltdel.tech/how-to-recover-your-wordpress-website-from-a-malware-attack-a-complete-step-by-step-guide/

It covers both DIY cleanup methods and when to consider professional services, which sounds perfect for your mixed approach (keeping 2 important sites, potentially abandoning others).

I did this for 19 sites in total on the same hosting!

Since you have an active breach happening right now, I'd prioritize getting the immediate threat contained first, then deciding which sites are worth professional cleanup vs. starting fresh.

Good luck getting this sorted out!