I haven't looked through all the backupwordpress code just yet, so this may be unfounded. But is there any reason add_action('init'... is called outside of the wp-admin pages? I don't see any reason for things like bkpwp_security_check() to be called every time a non-admin page is loaded. This means that bkpwp_security_check() is writing the backup/.htaccess file every page load, which is a bit excessive.
From what I can see (and tested personally), a quick check before calling the add_action('init', like the below (not compatible with IIS), is much more reasonable.
if(strpos($_SERVER['REQUEST_URI'], '/wp-admin/') !== false) {
Cheers,
Stonacek