But yeah you're definitely right about the nature of the contracts being immutable, unless that immutable code contains some setter that delegates the function calls to some other contract.

ERC-721 (NFTs) actually has a nice way of dealing with sending NFTs to an incorrect address by checking if it implements a special interface if the recipient is a smart contract. But any measures come at the cost of extra gas so they are usually avoided.