Gravedigging: Mystery solved!
There was an undocumented "Target OTA" flag sneaked in those packages that KindleTool missed.
The re-spin did indeed update it (I had the original re-spin on hand, and it had an earlier OTA target than the currently available packages).
In any case, it's still related to the downgrade "protection", and we still can't re-spin them ourselves. But at least it makes sense now

.
f.g., the current PW4 VV package is now properly parsed, and should be okay for a while, since that build revision is slightly higher than current public releases (5.10.1.2 is @ 3360340004 at the time I'm writing this):
Code:
Checking update package 'update_voice_kindle_all_new_paperwhite_v2.bin'.
Bundle SP01 (Signing Envelope)
Cert number 2
Cert file pubprodkey02.pem (Official 2K)
Bundle FB02 (Fullbin [signed?])
Bundle Type Recovery
MD5 Hash 0972ac8006a472cb9e599edd8161d672
Magic 1 2048630901
Magic 2 1897089723
Minor 1
Header Rev 2
Target OTA 3372830002
Platform Rex
Board Unspecified