I got the impression that SRE basically have low level access to the storage stack. So wouldn't be subject to most of the normal application level logging that I would assume would red flag this behaviour pretty fast.

The only way to get around this is to have someone audit all their actions constantly, which you need someone equally or more familiar with the systems they are working with.

I think that is pretty impossible to implement that level of overview with humans, the best way to go normally is the 'buddy system' so no one can access a system unless they have a 'buddy' with them. Like the military do in nuclear weapon silos.