Okay, when installing from module.json, install now checks the version in the actual .module file to make sure it doesn’t get tricked into installing an incompatible version.