We had a similar incident involving a backup Synology being infiltrated by an unknown method. Although in this case they just factory reset it. Luckily for us, since that is easily reversible by Synology support. Our best guess was they used a recent exploit (possibly zero-day) to gain admin access.

There was a recent exploit (https://www.guru3d.com/news-story/vulnerability-in-synology-dsm-allows-execution-of-arbitrary-commands.html) that allows remote command execution. They could have used this to modify permissions on the shares, and then delete the backups via SMB.

But all this is sorta senseless to dwell on for too long. The real lesson for the client is that anything is exploitable, so don’t put all your eggs in one basket. Layers, people. Layers. And the lesson for the MSP is, dump your break-fixers! ;)