The problem is the bit about “The tag expression is only evaluated if the branches expression returns false”. You have to do a branch check first to cause the tag check to take place.
It is not clear why this limitation was built into the scripting DSL, but it is unlikely CircleCI can make any changes to it unless they issue a new DSL version, something I’ve not seen any indication of happening, beyond a comment on the following message exchange
That message exchange also indicates a possible workaround, where you use a filter that always fires with a branch and tag check. This then causes both pipeline variables to be populated and so a job level ‘when’ condition should be possible.