don't think @ODELL knew about entropy There was a USB bug in this version bump that would not have affected air gap usage (which would have been in the guide, i know because i used them). Details here on the bug: March 17–29, 2021

COLDCARD Security Disclosure History – Coinkite

History of security research, coordinated disclosures, professional reviews, internal findings, and advisories affecting COLDCARD.

"Firmware 4.0.1 was the first public 4.x binary, so public users were not exposed to this regression." If 4.0.0 was never released then no users were ever vulnerable to this usb bug? It has to be something else.

do you think listeners to RHR would compile their own CC code? that seems likely given listener demographic but maybe I'm off on that.

As far as i can tell 4.0.0 was never released. If 4.0.0 was the usb issue under secret discussion here i don't see how you can be protected from something not public.