What happens to old backups when the retention policy is modified?

Let's assume that I have a Windows server backed up by Windows Azure with a retention policy of 21 days.

Now assume the server is compromised. Can the attacker just "delete" my old backups by modifying the retention policy to, say, 7 days? Or is the "expiration date" of a restore point fixed at the time when it is created?

What happens the other way around? If the retention policy is set to 7 days and I increase it to 21 days, will the old backups still expire after 7 days or is their expiration date updated?