When a transaction is added to a block, it can be considered immutable in the sense that the data within it cannot be altered without also invalidating the cryptographic hash of that block. This means that any change would require every block after it to also be updated in order for the chain to remain valid, which is highly unlikely given the decentralized nature of many blockchains. However, this does not mean that all transactions on a blockchain are 100% immutable.
It is theoretically possible for someone possessing enough computing power and resources to reverse a transaction in order to double-spend or carry out other malicious activities. While this would still require a significant amount of effort and technical expertise, it is still possible.
In addition, some private permissioned blockchains may have changes made retroactively if consensus among the validators allows for such alterations. This goes against the original spirit of decentralization and trustlessness that most public blockchains attempt to create.