There was a reason you were given a template to complete when you submitted the PR. It was not for fun. Please update your PR with the relevant information - you can find the template here https://github.com/joomla/joomla-cms/blob/5.4-dev/.github/PULL_REQUEST_TEMPLATE.md

It is expected that everyone who submits a pull request checks their work before submitting

Hi @mmustafasenoglu, thanks for your PR.
I don't think this is the right way of fixing this issue, checking for com_content permissions in the tag model that could be used by other components will lead a user that have core.edit permission on just the com_content to access the states of the rest of the components too which is absolutely wrong.

tag.state is a flat value that is used in the query of other components too according to what I've found.
So, working on this issue will require some engineering plan to get to a valid solution.

Thank you for the detailed feedback. You are right that checking com_content permissions in the shared tag model could expose unpublished states from other components. I also apologize for submitting the PR without completing the required template and without catching this issue beforehand. Since the current approach is insufficient, I will not update the PR with misleading information and will leave the engineering work to be addressed properly.