They don't have to be backed by a state, however, it's quite obvious that "permissionless", "uncensorable" and "truly anonymous" are features that won't be accepted by states for a legitimate currency (just as they aren't really tolerated for cash, driving all kinds of restrictions and controls of non-tiny amounts of cash), so it's quite plausible that in the long run the legal businesses and law-abiding citizens will be allowed to interact only with payment mechanisms that have disabled those features in some way; so if any given cryptocurrency unavoidably has those features, then people will be prohibited to touch it, limiting their usage only to criminal purposes.