FWIW, I tried looking into how we can prevent or detect monkeypatching of "sys.audit", and the answer seems to be that we need to define a custom type for the sys module and for sys.__dict__.

I'm not prepared to do that yet, and IMHO there are enough way to detect someone patching it to nothing (all your logs disappear) or patching it more cleverly (someone ran some pretty complex code to redefine it) and events from native code can't be suppressed either, so I think it's fine. 

But I won't refuse a contribution if someone thinks this is a critical scenario (though I will push hard to make sure the implementation is solid, as I think this is pretty hard to get right).