Question on Auditing 12C
AUDIT_SYS_OPERATIONS


  The audit records are written to the operating system's audit trail.


SYS audit entries are not stored in the database, but on the host in text files (or the event log on Windows).

But yes, you are correct, if you are SYS, you have full access to the database, and the host, with the user the database runs as. So yes, you can manipulate audit rules and data as well.

For that reason (and performance-wise), usually I suggest using AUDIT_SYSLOG_LEVEL, and configuring syslog to forward all entries to a remote server.