> For example, if the copyright holder applies a security fix to an old version that had "expired" and is now open source, will that cause old version to revert to source-available?

Yeah, it’s tricky. By default, I think it does go back to source-available, but I would trust the vendor to explicitly release the fix as open source instead. Of course, it should be addressed in future versions of such licenses, and in the meanwhile vendors should promise to not hold security updates out.

It’s not something exclusive to delayed licenses though: vendor of a permissively licensed software can make a security fix under a proprietary license. They don’t do this because it would be a dick move and the community will fork the software, but this is a possibility.