The upgrade_db() code compares version numbers to figure out whether to automatically attempt to upgrade.
It assumes that a version mismatch implies that
new_version > old_version.

However, I have run into a case where I (accidentally) access an already upgraded (version 4) database with an older installation of roundup (version 3).

While this is arguably a user error, roundup should (and easily could !) protect against inadvertent (and probably corruptive) 'downgrades' like that.