Hi Paul,
(1) Use Board Manager of Arduino IDE to get latest release. Commits shown in the Github Repos might not be included in the latest official release.
(2) You can find the bug fixes in the Changelog and in the Release Notes.
More details are in RAK3172 does not respond to AT+ commands after 48 days
There were two main issues. First was a timer overflow which caused the modules to hang. Second was an NMI triggered by fluctuating power supply which caused the modules to hang. Both are solved in V4.0.6
(3) LoRaWAN mode does not have this problem. Encryption is handled by the LoRaWAN stack with either the keys received during OTAA join or with the keys set with AT command (or API call) for ABP.