Oh that's a cool idea. Super useful for detection and response teams, guessing they're able to get some of that by standard OS telemetry via agents/EDR.
Having an audit trail is really important for medium-sized shops where a lot of senior devs still have the keys to prod and kind of need to as they're still the defacto ops team and have to be able to get in quickly to investigate faults or poke at systems to get them back online.
At the same time, when something is left in a bad state, you want to know how it got that way and when; not even necessarily just to punish people, but so that the right people are in the room to explain the full circumstances of what they did and why.