It's important to note the difference between the Immutable policy (for how long a backup version is write-protected) and the Retention period (for how long a backup version is kept before it is deleted).

A backup version can end up running out of protection (therefore becoming mutable) and still exist in the backup location. For instance, if your Immutable policy is set to 7 days and you still have backups that are older than the specified 7 days of protection within your backup location.

In this case you will see the messaging that Immutable backup locations contain backups which are at risk, to warn you that you have some backup versions that are no longer immutable.

The difference is that the Immutable period starts counting from the time when the backup was taken, so essentially "backup time" + 7 days. On the other hand, the Retention period is calculated from the time of the last Successful backup, so essentially if no new backups are taken to replace the immutable ones, that's when these backups end up "stale" and therefore at risk of being tampered with.