Because an attacker would never cover their tracks...
Indeed, being able to trust your audit logs is imperative.