Can immutable backups still contain ransomware?

Yes. Immutability prevents a backup from being modified or deleted during its retention period, but it does not prove the contents were clean when the copy was created. If compromised files, encrypted data, malware, or attacker persistence were already present, immutability preserves them too.

That does not make immutability optional; it makes validation necessary. The useful recovery copy is the immutable copy that has also been inspected and confirmed clean.