If you run "apt source" for the package you'll see it - like lots of other packages - point you to the git repository when the packaging is maintained in a public git repository. The Vcs-Tag field in the package lists is the magic that triggers that message.