It's true that policy file in drush prevents sql-sync from local to prod? I know in the policies file in drush there was/is a way to prevent sql-sync'ing from local to prod.

Is this still true? If so how do you go about this?
Yes this is still true you can find the relevant snippet in the drush source code:

/**
 * Implement of drush_hook_COMMAND_validate().
 *
 * Prevent catastrophic braino. Note that this file has to be local to the machine
 * that intitiates sql-sync command.
 */
function drush_policy_sql_sync_validate($source = NULL, $destination = NULL) {
  if ($destination == '@prod') {
    return drush_set_error(dt('Per examples/policy.drush.inc, you may never overwrite the production database.'));
  }
}


You should include the policy.drush.inc in your .drush folder usually located in the users home folder.