My belief is that if someone uses the "Release" mechanism, that is covered by
the sentence which states:
"If the upstream does create tarballs you should use them as tarballs provide an easier trail for people auditing the packages."
By creating the tag, upstream has clearly indicated their intent; who are we to second-guess them?
The commit hash part comes into play when a Revision or Tag has not been created.
I also added some verbiage to my draft which discusses your point about the different naming conventions that
you have observed.