I’ve had to do forensics on a rogue change. In finding when and who actually changed the file, mtime can help narrow it down when compared with wtmp.