Write access to a log is also the ability to rewrite history
An ordinary log offers no structural protection against after-the-fact editing — anyone with write access to where it's stored can alter a past entry, and the file itself gives no indication that it happened. This becomes a real problem specifically because the person best positioned to want an entry changed is often exactly the person whose actions the entry recorded, and who may also hold legitimate operational access to the system storing it.
A tamper-evident structure — typically chaining each entry cryptographically to the one before it — changes what an alteration costs. Editing a past entry breaks the chain in a way that's detectable by anyone verifying it later, even someone who gained access to the log after the fact and tried to cover their tracks.
Detection, not prevention, is the actual guarantee
Tamper evidence doesn't stop someone with sufficient access from attempting to alter a log — it ensures the attempt is detectable rather than invisible. That distinction matters for what the property is actually good for: it doesn't substitute for restricting who has write access to logs in the first place, but it provides a check that holds even when that access control eventually fails or is bypassed.