Wt

While there is no vulnerability to resume a session that was previously logged out, due to how login state is managed. It seems clean to also change the session ID.
This is what OWASP recommends.

The Auth::Login::logout() will change the state of the Login object. This Login is unique per session, and thus identifies the session as being logged out. Any request that would then access information that ought to be guarded can recognize the state, and not allow access to controlled data.