Samba cannot be a Backup Domain Controller for an NT4 PDC because:

While encryption levels can be a factor in compatibility, the primary reason for Samba's inability to act as an NT4 BDC was the lack of SAM replication protocol support, not solely encryption. Samba versions capable of NT4 emulation generally supported compatible authentication and encryption methods.

Samba, particularly in versions designed to emulate NT4-style domains (like Samba 3), was able to act as a PDC or a standalone server, but it lacked full implementation of the proprietary NT4 SAM database replication protocols necessary to seamlessly function as a BDC replicating from a Windows NT4 PDC. This limitation prevented it from being a true drop-in BDC replacement for an NT4 PDC.

While database backends differ (Samba uses its own TDB or similar, NT4 uses registry-based SAM), Samba's design often involves abstraction layers to handle these differences; the core issue was the replication protocol, not merely the backend storage incompatibility.

The technical capabilities and limitations are driven by implementation challenges and protocol specifics, not by the Samba team's philosophical stance on encouraging or discouraging certain domain setups.