agree, that doesn't make sense. i think they did release it: see https://x.com/COLDCARDwallet/status/1372247111719337991
but for some odd reason decided to say they didn't. either way, i know this entropy bug was in 4.0.0 and the only coding change in 4.0.1 was what i posted.

If they say from 4.0.1 onwards it's because 4.0.0 was never officially released.

"Version 4.0.0 was built, signed, and tested internally, but its binary was never released publicly. The contemporaneous signing manifest records that internal build and does not indicate public distribution. Firmware 4.0.1 was the first public 4.x binary, so public users were not exposed to this regression."

The entropy bug existed in 4.0.0, I checked the commits. It was not added between 4.0.0 to 4.0.1.

The bug in 4.0.0 is this which was fixed in 4.0.1. It had nothing to do with the entropy bug that already existed in 4.0.0

// 4.0.0
bool ckcc_vcp_enabled = true;

// 4.0.1
bool ckcc_vcp_enabled; // defaults false

Hope you sue CoinKite and get it all back