A firewall usually reads the rules from top to bottom and applies the first match. So when your first rule is deny everything , it will deny literally anything before the second rule will be applied.
Your deny rule should always be at the end.
I think you should provide more information about the rule you created.
Like others said: it depends.
In my opinion the most important thing to have is an off-site backup. If you have achvieved that, it’s only a matter of how long you are willing to wait for the recovery. If your answer is something like “it cannot wait” then you should go with at least raid 1 and consider additional meausres for the event when your whole array fails.
Well what should she do if TS is refusing the money?