Yes, they are immutable. It's only possible to "yank" a specific version, which will prevent new dependencies, but it will still be available for download for existing dependencies.

https://doc.rust-lang.org/cargo/commands/cargo-yank.html