It seems even the currently accepted answer does not really address the part of your question how to avoid that someone accidentally accesses an old commit, uses that older state of the code base in a new branch and so introduces an old vulnerability again.
IMHO the only way right way to adress this is:
by documenting any bug fixes as well as vulnerability fixes rigidly in the "release notes" (or "change log") document of the system
by making sure all devs who access older versions of the code make sure they read the release notes, check which issues have been solved in the version of the code which came after the one they are going to use
When reusing an older version, or branching from an older version of the code base, it is clearly the reponsibility of the devs not to do this blindly. It is clear they must cross-check the already fixed bugs and vulnerabilities, for not introducing them again. The VCS log, however, is not really a good place to find this kind of information, because usually there are all kinds of changes mentioned, on a too low level of abstraction.
Release notes, however, should contain a "new features" section as well as an "issues solved" section. And the latter should be the first place to check before branching from an older version.