Correct me if I'm wrong, but you would be able to prevent this specific issues with the "Rules" in order to block updates of tags; https://github.blog/news-insights/product-news/github-reposi...

Yeah but no GitHub Action is going to do this because updating tags is the de facto mechanism for releasing patches for those repositories.