If GitHub really cared about security they could fix this tomorrow by declaring any tag linked to an action immutable.

They don't because they don't.

Anybody who's ever moved a git tag knows the ergonomics of doing so are so awful that you're obviously not supposed to be doing it.