A subversion repository is just a single tree of files and folders, where you can get any portion of that tree at any version in its history at any time.
As others have said tags/branches/trunk is all just a convention on top of that, subversion allows you to copy one portion of the tree to somewhere else for (almost)free, but in it's core, that's about it.
You're right that you will need a maintenance branch for your version. The tag acts as your name for any particular version sent somewhere external - and the commit comment when you create the tag gives you a chance to explain where it went and why (eg, "public beta release", "requesting comments").
There are several hook scripts out there that prevent you making modifications to a tag, but they won't be implemented by default because some people use subversion in a completely different way (eg, config file backup, etc). Subversion is a generic tool, there's no 'right' way to use it, just strong conventions for common situations.
In fact, collabnet are starting to consider how revision control is used for non-development projects. The whole idea of tags trunk and branches may be irrelevant for some of these.
My convention when thinking about a source code repository is:
- Trunk - the complete list of revisions that may be released to live
- Task - an external description of a job/bug that groups a set of revisions
- Development branch - a set of revisions that aren't yet ready for trunk
- Maintenance branch - a place to collect revisions from trunk for release
- Tag - a named snapshot of a maintenance branch
Tags can also give you a usable url for documentation, eg:
"The release is available at http://svnserver/myproject/tags/1.0"
It could be:
"The release is available at http://svnserver/myproject/trunk@4483"
But when you're browsing through the repository, you'll never come across @4483 and know that it was in any way special.