Kinda curious why releases just aren't fully immutable? Sane semver would dictate any update should at least be a new patch release.
The files in a release are immutable, but a release on pypi consists of multiple files for binaries that is a cross of architecture, os, and python version. Per other comments the upload api is stateless. The consideration is an attacker adding new files to an old release
loading story #49048950