Bingo.

I'd say use cases are home users sure but it would be even more appreciated in schools and offices. In those scenarios you're more likely to worry about security concerns than an end user accidentally borking something and having to revert.

No, the root system being read only is not a security benefit. Attackers (with root or a root exploit) can remount as read only, or remove the immutable bits on files.

In addition to that, thinks like /var usually contain persistent state which can be written to, even on an immutable system

Now, an attackers changes to the root filesystem would probably be overwritten on the next image upgrade. Although better is impermeance, where the root filesystem is generated from config files on boot (NixOS can do this). That is better because now the system is wiped every boot, however it runs into some of the same issues: an attacker with root can modify the update mechanism, or the persistent config files.

While I would say that an immutable system offers practical security benefits, in that most existing Linux malware probably is designed for an orthodox system, it doesn't offer theoretical security benefits. It's just security by obscurity that will probably wane if/when immutable distros get more popular.

Followup question, how do system files get patched if its mounted as RO?