They're only useful for simple problems – e.g. a user-level compromise or an innocent mistake by non-malware. If anything malicious ever gets admin privileges, you still need to reinstall from scratch.

Since you need a real backup solution either way I've always disabled restore points since they're at best redundant.