A very (very) remote possibility, if you have NTP synchronisation set up, is that the time was synchronised between the child writing the file and printing its log message

Nice idea! Unfortunately, it does not apply here, because the evidence is not only the timestamp, but also the plausibility check we are doing: After the master received waitpid -1, it checks the control file, and this file did not exist at this time, but existed afterwards. This, together with the log entries from the child, shows that indeed the child was still running at the time.