One of the businesses I work for was almost the victim of this backdoor. I don't know why Updraft Plus is storing never-expiring private keys on their servers. And my understanding is that sites get enrolled in remote management (and thus generating a private key on their servers) by a default-ticked checkbox. It's probably what happened to us.

We were targeted but likely protected because we had DISALLOW_FILE_MODS set to `true`. Although enabling it makes updating plugins, themes, and core wp painful, it's totally worth it IMO.