If someone hacked the website and could modify it, it does mean there is a security gap (vulnerability). Restoring a backup will only remove the effects of the hack, but the exposure will remain unchanged. This means the attacker can easily break into the website again.
What is also crucial for the cleaning work, restoring the backup, will cover up the traces of the hack, making it impossible to identify the infection and analyse how it happened.