If they say from 4.0.1 onwards it's because 4.0.0 was never officially released. "Version 4.0.0 was built, signed, and tested internally, but its binary was never released publicly. The contemporaneous signing manifest records that internal build and does not indicate public distribution. Firmware 4.0.1 was the first public 4.x binary, so public users were not exposed to this regression." The entropy bug existed in 4.0.0, I checked the commits. It was not added between 4.0.0 to 4.0.1.

My understanding is the bug was introduced in 4.0.0 The confusion comes from the fact that since they patched a bug in that version, they removed it from the list of releases instead of keeping it and adding a "THIS IS A VULNERABLE VERSION" disclaimer. Therefore people see that the first version released after 3.x.x was 4.0.1 and assume that this was where the bug was introduced.

Oooh that is in fact quite different yes... why would @NVK (who i can't tag anymore) so vehemently warn @ODELL about a bug in a unpubblished Version?! 🤔🤔