I think you misunderstood what it means. If I understood it correctly, the datastore is append only, but nothing should prevent you from modifying history and pushing a new head.

I sure hope that there is an equivalent of git-filter-branch, though. In case someone commits SSH keys or secrets accidentally, just overwriting them and leaving them in the database is not good enough.