They cannot.
It is not possible for anyone to change or edit a Journal Entry created by a bank statement.
If a User tries to edit such an automatically created Journal Entry, they will be stopped with a blocking warning "You can't manually change the state of journal entry ... as it has been created by bank statement ...:".
We have been involved in many projects that were audited and the feedback we got from Auditors was that the design of Odoo was clear and had good controls because only the "process" in Odoo related to bank reconciliation is allowed to update these specific Journal Entries - Users cannot.
The process updates the account on the posted entry - from suspense to the incoming or outgoing outstanding account. Users have no ability to edit the entry before or after the update.
These entries are also clearly linked to the Bank Statement that was the source for the update - an authoritative record which verifies and validates the prior entry made.
In our experience Auditors are more concerned with a lack of controls around Users being able to change things.