From my testing the version tag was included right after to denote the new password encryption, meaning if it is not present it is an older style config and vulnerable.