What happens if a random wordpress blog's frontpage (/) is compromised and has malware injected, setting the immutable keyword? Cloudflare and letsencrypt means most sites will be https sooner than later, so the https part will be "taken care of". (At least that's better than nothing; imagine the power granted to captive wifi portals if not!)
I think it would be bad practice to use this keyword on end-point URL's that are advertised in search engines or API documentation.
You would want to use it for resources to which base pages and manifests point; such as JS, CSS, JPG, PNG, etc.
The browser could enforce that, sort of. It could ignore immutable cache status on the object that is actually in the browser location bar and IMS it, but it could allow it on referenced objects.
The idea is that referenced objects can simply stop being referenced, and a fresh object is referenced.
I think the point is that it would be renamed /parallax-plugin2.js and HTML would be set to reference that instead? That is why immutable cache shouldn't work for the page in the address bar.
The concern here is that even after recovery from the compromise, the site could then never use the name "parallax-plugin.js" again, because a browser might have the cached malware under that name instead of the correct version.
On top of that you as a developer would have to understand what's happening and that it's happening at all. Might be not easy as we have a habit on clearing our cache all too often :)
There's max-age support, the ability to preload pins in the browser, and certificate transparency to work around this, see section 4.5: https://tools.ietf.org/html/rfc7469#page-21
As to this original point, it would be best if this didn't apply to the address bar URL / main document request. But it's a good point, worth considering. Perhaps the UA should set a timer, and two or three refreshes in a row would be the equivalent to the prior refresh behaviour.
Or simply the domain is resold, but old visitors still see a page from a year back. Immutable is useful, but the max-age limit should be limited to a few hours, which is an acceptable timeframe for internet disruptions (e.g. DNS).
