We’re seeing this at work too - our public git frontend is constantly getting scraped as well as our self hosted issue tracker. We had to spend days working on fail2ban and other kinds of tools to mitigate all the traffic that’s adding tons of load to our instances, which otherwise would easily be able to handle the handful of employees who actually use these systems.

Nowhere did they say that those statements mean immutable to them. Just that your claims that OP “literally said they didn’t want immutable” is not based in reality.