Yes, they can. The thing is that tarballs are not part of release artifacts, even though they do appear to be among them. If you look closely, even the endpoints that user uploaded artifacts and generated tarballs point to are different.

Github could just generate the tarball once and store it in the same way as other release artifacts. But for some reason they chose not to.