You could literally remove my entire root directory and at worst you've minorly inconvenienced me: I now have to boot from a USB drive and run `zfs rollback` to the most recent snapshot. I'd be impervious to most ransomware as well: my home directory is filled w/ garbage now? Good thing it can't encrypt my read only snapshots, even with root access. Oh and I can serialize those snapshots across the network at the block level before I nuke the infected machine.
Of course humanity will always invent a bigger idiot, so it's possible a virus could gain root & exec some dangerous ZFS commands, or it's possible some MSFT employee could pass the `-r` flag and recursively delete a dataset & its snapshots in their post-update script. Plus let's not forget that no filesystem in the world will stop you from just zero-filling the drive. Still it's easy for me to imagine a world where I'm completely impervious from ransomware: by way of only being able to delete critical snapshots when a hardware key is present or when my TPM is unlocked.
On the whole it seems to me CoW filesystems are a major step forward in safe-guarding users from accidental deletions. At a minimum they have other benefits (serialized incremental send streams, block level compression & dedup, etc.) that make backups easier to manage. -- Yet I still can't boot from ReFS on Windows.