The upgrade_db() code compares version numbers to figure out whether to automatically attempt to upgrade.
It assumes that a version mismatch implies that
new_version > old_version.

However, I have run into a case where I (accidentally) access an already upgraded (version 4) database with an older installation of roundup (version 3).

While this is arguably a user error, roundup should (and easily could !) protect against inadvertent (and probably corruptive) 'downgrades' like that.

Roundup will now raise an error if you try to run a new database with old code. Of course this only applies to Roundup 1.4+ so you'll just have to be careful with older versions.