TL;DR – latest release in API is the last release you created, not the “Last Release” marked in the GUI or the date of the tag.
So it turns out that GitHub has a bug in the way it marks releases.
On the GitHub page you may have a green box next to your “Latest Release” (which uses the tag timestamp) and think all is fine. But the GitHub API has a different idea – it uses the date when you created a release using the GitHub web interface.
This means that if you retrospectively create a release for an older tag, it won’t show up as “Latest Release” in the GUI, but it will be used as the latest release by the API, potentially stuffing up third-party integrations!
Releaser beware!