A tag can be changed. Barring the extremely unlikely chance of a (non-malicious) hash collision, the commit hash will always identify the specific commit intend

A tag can be changed. Barring the extremely unlikely chance of a (non-malicious) hash collision, the commit hash will always identify the specific commit intended by the referrer. As commit hashes ought to be globally unique—the same hash can appear in more than one repo but they will all have the same content and history—GitHub could offer a shorter form of the URL which omits the user and repo names, in exchange for a longer minimum hash length. This would require creating an index of all the commits reachable from public repos, unless they already track that.