TL;DR: I'd suggest you to alternate two SDs, to enable Windows Defender Ransomware Protection and to consider switching to incremental backups.
Your setup is better than the default one, but it seems to have a couple of weaknesses:
- You might inadvertently synchronize partially encrypted files, propagating the encryption to all media
- Depending on how your synchronization app works, attackers who compromised your cloud drive might encrypt it and wait for the encryption to propagate locally
- Local malware might escalate privileges to local administrator bypassing UAC, proceeding to both harvest cloud credentials and then to encrypt local disks
The key to protecting from ransomware is making valuable backups inaccessible from the potentially infected host. That can be achieved by alternating backup media, or by having a different host access your host and pull the files. You can alternate a couple of SDs (I always keep one encrypted backup in my wallet), or simulate alternating media by having your administrative APP do incremental backups (though that remains exposed to privilege escalation).
Mind some advanced manual ransomware attacks of the past were known to start by encrypting backups, patiently waiting for months for all copies to be overwritten. Only then they proceeded to encrypt the actual data and ask for the ransom. One assumption of IT security is: "the attacker knows your system".
Modern anti-malware software also helps, as it usually includes shadow backup solutions and behavioral analysis detecting and stopping ransomware, but it is not a silver bullet, also because it is subject to the aforementioned privileged malware. In any case activate Windows Defender Ransomware Protection.
Balance the cost
As usual the key point is: how much security is enough? Just enough. If you don't have very valuable data, don't look for the full mitigation, as costs increase exponentially (also in terms of time) but security increases asymptotically.
By backing up unencrypted files to media or the cloud you expose yourself to data leakage. I strongly suggest encrypting backups.