There are actually some approaches that makes smart contracts "upgradeable" but it involves using a special base class that proxies everything through delegate calls.

But yeah you're definitely right about the nature of the contracts being immutable, unless that immutable code contains some setter that delegates the function calls to some other contract.

ERC-721 (NFTs) actually has a nice way of dealing with sending NFTs to an incorrect address by checking if it implements a special interface if the recipient is a smart contract. But any measures come at the cost of extra gas so they are usually avoided.

Doesn't the WETH smart contract store all the tokens it receives at its address? Doesn't anyone have the private key of that address?

It's been quite a long time since I have been playing with smart contracts and I don't actually remember what happens when a smart contract is created.

Don't know the code for specific code for that contract but contract wrapping/unwrapping doesn't necessarily imply that anyone can withdraw ethers sent via normal means. If the contract is upgradeable it would be possible but being upgradeable should be built into the contract first.