There should be a way to re-tag only the file(s) that contain the fix.
It's possible to edit the tag itself (rather than the trunk/maintenance branch), but then you also need to merge the changes back into the trunk. Also, editing the tag effectively makes it a branch; such usage is discouraged (and it will screw up conversion to, say, bazaar, which assumes a tag denotes a single revision).
It would be possible to create a branch just for the release, but that's more tedious.
In the specific case, I think it would be best to create the maintenance branch earlier; then only that branch needs to be frozen (instead of the mainline).