The alternative is a package manager like yarn or paket where even your transitive dependencies are pinned in a lockfile. I don't see how someone can look at a version spec made of only top level dependencies and call themselves immutable.