Doesn’t immutable distro mean the root filesystem is readonly and programs are created with their own unqiue environment?

This post acts like the code for the OS should never change.

So if a critical CVE is reported they cant update ths OS because its supposed to be immutable?