Nobody sane would, intentionally. But I'd bet the house on it happening by accident quite a bit.

At a technical level, I like this idea. When used well, it makes sense to allow. It's hard to fault it without bringing in human error, politics, or economics.

At a practical level...

I can't wait to see what happens when a bug allows Facebook to serve this header on all pages, even for a few minutes. The most Facebook dependant folks around, those checking their phones every five minutes, will be stuck in a perpetual time freeze, unable to move forward ;).

I also can't wait to see what happens when a government tries to ban a cache-control: immutable page.

Or even what happens when, someday, Google is selling it's assets and gets to "google.com.". (Someday, itll happen - Google won't exist for all eternity)

Fully agree you have to be extra cautious and that in complex setups it can happen accidentally.

But so can happen a myriad of other things: returning too long "Expires" value for some content (in months instead of days), misconfiguring ETags etc.

If you can construct an attack out of it, relying on people doing sane things is dangerous... (I'm not sure this is interesting enough as an attack vector, but "but nobody would do that" is a bad answer a lot of the time)