In theory someone could be relying on the bug, and not be vulnerable - e.g. if they don't allow any external access to the system.

If you just re-publish the old version, it's difficult to know whether you've taken the change.

If you are going to reissue the same version number - why bother having version numbers at all?