For the vast majority of files, whether those are executables, config files, or libraries, nix doesn't just put them in standard locations for Linux systems, but instead puts them in /nix/store/ with a directory derived from a hash of all its inputs and dependencies. For example, I have mpv in the nix store at /nix/store/08a907bw4csdc44408a992lnc9v2802c-mpv-0.38.0 and this has the default config, the binaries, completions, libraries, etc.

Since the directory is titled based on the hash of the various inputs that go into building the package, when I run an upgrade it's not going to overwrite the old version of mpv, but instead it's going to put the new version in the nix store as well, at a different directory. Until you collect garbage, to clear out the old versions of things you're not using any more, nothing is deleted.

So while you can add and delete entries to the nix store, each entry itself is read-only once it's been built, and thus immutable.