Is there any industry standard about if a compromised version is distributed via one channel, the owner does or doesn’t drop/bump that same version on unaffected channels too?

Edit: the below was incorrect, left for posterity, the release can be deleted and then the tag as well.

Also, all their tags are immutable, and so can't just be deleted to hide things: https://docs.github.com/en/code-security/concepts/supply-cha...