Given that action's versions derive from their repo's tags. Can one change an already published version by moving the tag to another commit?
If so, it's a serious security problem.. but I can't find any source to reassure me.
Anyway, it is always possible to use commit id instead of version:)
Yes, that's possible. When a tag is moved to point to a different commit, the corresponding release becomes a draft and it disappears from the Marketplace, but it can be published again.
Notice that an action doesn't need to be published on the marketplace to be used anyway.
Moving tags is actually the official recommendation for major versions and it has been debated; that discussion mentions that versioning will improve when moving to using the GitHub Package Registry for Actions, but that hasn't happened yet and the GitHub roadmap doesn't mention it, as far as I can tell.