The important thing is that tags are signed and up-to-date, like how git tags work or how Debian signs its entire repository as a unit (via the Release file) rather than having developers just sign individual packages. Otherwise, even if it's signed, it's subject to downgrade attacks.
Installing known-vulnerable old versions of legitimate software can be just as bad as installing custom malware.
Installing known-vulnerable old versions of legitimate software can be just as bad as installing custom malware.