The DOI is linked to a zip archive on zendodo / figshare, which will not change, even if you change the tag.
So if you publish the DOI as a part of a paper, and then later improve the code in the Github repo (but of course not in the archived snapshot), is there some way that the people who follow the DOI could also find the improvements?
If you sign your tags with your GPG key, and only rely on tags signed by GPG keys that you trust, then you can trust the tag as much as you trust the holder of the key.