one instance I can remember immediately - lead SRE turns off an alert for some DLQ that has been finicky and experiencing periodic issues, often requiring intervention from the on-call team. he doesn’t tell the on call team he turned this off, suspecting that after a day or so something downstream will blow up. Then it does, he appears out of nowhere to save the day with the precise solution and looks like a genius for it.
At my place we would wonder why the alert was turned off which would most likely have been audit logged in some way. Perhaps they only play chaos monkey in systems where you can change things anonymously.
Have you never heard of a volunteer firefighter starting fires? It doesn't happen often, but it does happen. (And maybe with professional firefighters, I don't know.)