You're correct. I never mentioned that an upgrade step was made for this; however, it seems it only removed the lingering entries that had been approved. Lingering entries from deny/soft-delete still lingered. I have now updated this step and put it in the next version's upgrade script.
Still, in 4.0.1, you shouldn't get any new lingerers like this.