Yes, they are immutable. It's only possible to "yank" a specific version, which will prevent new dependencies, but it will still be available for download for existing dependencies.
https://doc.rust-lang.org/cargo/commands/cargo-yank.html
To elaborate on "prevent new dependencies", dependency resolution will never choose a yanked version. However the yanked version remains hosted.
To elaborate on "prevent new dependencies", dependency resolution will never choose a yanked version. However the yanked version remains hosted.