You're mixing governance (what's permitted and not) with implementation (how we do stuff). Immutability is an implementation thing. A mistake or a fraud is a governance thing. There are use cases for immutability (the case you mentioned, you want to know what happened with your stolen BTC, you want to trace the transactions and be sure they haven't been tampered with) and there are use cases for mutability (again, the case you mentioned, you want to be sure you can roll back your transaction).

That's the biggest challenge of humanity: how to mix governance and implementation right.