Keeping multiple snapshots

Am I right in thinking if the data on a share doesn’t change much then there shouldn’t be to much overhead involved in keeping multiple snapshots of that share?

Also presumably if the snapshots are not visible to the user then they shouldn’t be affected should something like cryptolocker happen?

On this, correct. Not sure on your other question.

The bitlocker question would largely depend on if the snapshots still get mounted/exposed to CIFS/NFS if they don’t then they should be relatively safe.

Not that I expect to get infected but you never know it only takes one slip up.