Well it definitely can change from empty to containing something.
It can also change from the fallback code (if I force a bad environ-uuid in ~/.juju/local.jenv, and then connect to the environment, the direct connection failure is treated as a api.Open failed, just like if it couldn't actually connect, rather than a more critical something is actually wrong failure. Which is certainly a bug).
And then it falls back to "use the apiConfigConnect code, which doesn't know about environ UUID, and overwrites it with the 'correct' value).
We can make this code more pessimistic, and only allow it to be set from the empty string, but we do at least need that ability.