Protected branches doesn't protect correctly when pushing tags!

Summary

git tag vX.Y.Z; git push --tags causes code somehow to pass repository even when master branch is in protected state. Changes are made are inside such tag, but not inside master (HOW?!) nor on graph. I can't find this change in file commits too. It's just visible inside tag.

Steps to reproduce

Make 'master' protected.
git push (cause you forgot…), you're getting "You can't push here, this is Protected".
Didn't noticed error…
git tag vX.Y.Z
git push --tags
See new tag with your changes even they are non-existing in repository actually.

More fun:

We have RPM building running there and one of previous versions of software has my changes. Next version doesn't cause someone else did changes to software and built new version

What is the current bug behavior?

See above. Non-existing code which exists? (WAT?!)

What is the expected correct behavior?

Pushing tag should be impossible this way.