Is author.php a core file?

If you are talking about author.php in your theme directory, usually at wp-content/themes/<YOURTHEMENAME> this isn’t a core file but part of your theme.

Themes don’t get changed when WordPress is updated, so concerning WordPress updates themes are safe.

But if your theme isn’t custom made by you (which I assume here) this file would be changed if you update your theme. So to be safe you should create a child theme as child themes make it possible to update the parent theme while keeping your child theme changes. Details about how to create a child theme can be found at the WordPress Codex