You don't have to run your own repos for immutability. You just have to use repositories that say up front what will - or will not - change, and then don't do anything on top of them that expects something different from what that particular repo provides.

The question is why would anyone would expect immutability after pointing their package tools at a mutable repository?