Correct. Immutability does very little for security: attackers are interested in reading your files, extracting your authentication data e.g. session cookies and little else.

What really helps is application sandboxing, e.g. with firejail.