Sure, but they could also prevent tampering by just running a database themselves and not providing APIs that allow data to be tampered with. If they want to be

Sure, but they could also prevent tampering by just running a database themselves and not providing APIs that allow data to be tampered with. If they want to be able to prove it for external auditors, create a write-only audit trail the same way banks have been doing it for decades.