The things you describe are certainly signs of a site build that isn’t too healthy. What can happen in it? Anything. Who knows.
What are practical steps to get it under control?
There are roughly three components to WP site build: code, generated files (typically uploads), database state (config and content).
You take control of code by using version control and dependency management (such as Composer).
Many developers prefer to place hard restrictions on WP so it’s unable to write/modify files anywhere other than uploads folder. Dependency management captures and tracks exact state of the site’s code, rather than ad hoc updates through WP admin.
You take control of generated files and database with thorough backups.
You should have these in any case anyway. Backups should always be sent off site from where the site is hosted and managed by yourself. Never trust hosting to do backups for you. Having state of the data regularly captured not only saves you when things get broken, but also helps to compare states and trace down content and configuration problems to specific changes.