If they say from 4.0.1 onwards it's because 4.0.0 was never officially released. "Version 4.0.0 was built, signed, and tested internally, but its binary was never released publicly. The contemporaneous signing manifest records that internal build and does not indicate public distribution. Firmware 4.0.1 was the first public 4.x binary, so public users were not exposed to this regression." The entropy bug existed in 4.0.0, I checked the commits. It was not added between 4.0.0 to 4.0.1.