Rather than version tags, I’d prefer “should backport to maintenance releases” and “should backport to security releases” tags (with appropriately shorter names). These don’t go out of date and are actionable - potentially even automatable.
“Reported in version …” data is also useful, but probably only in the text of the report (i.e. through a bug template). Chances are that simply searching for version-like strings will find things well enough, and filtering by creation date also narrows down out-of-date reports, especially if we’re actively getting reporters to repro on latest versions when they report.