When SCORM activities are created the package file is editable, i.e. it can be updated as needed even after users have attempted the scorm.

But if users completed a scorm with lets say sco identifier 'a' but then we uploaded a new package that only has a sco with identifier 'b' then it will delete the old sco records along with the tracking (including lesson status), see here  https://github.com/moodle/moodle/blob/9242f9619ae6fb3881dbbc0c96030acd65ea5892/mod/scorm/datamodels/scormlib.php#L711

This has an immediate issue where the completion API is not informed that this record no longer exists, so the user can be shown as completed in the activity completion report (cached) but the "TODO" bubble in the activity for the user shows as grey/not complete (not cached).

But it also brings a more broader question of if the course editors are even aware they are deleting sco tracking records at all? My guess is they are not.

The simplest "fix" for this would just to detect this and add a warning, e.g. "Are you sure you want to update the package? Currently there are X users with tracking for SCO's that no longer exist which will be deleted if you continue"

A more "nice" fix could be to have a way to map the data, e.g. some sort of table where you say this map this SCO id to this SCO id and the data is migrated.