Z-Wave JS rejects device-replacement requests from ordinary nodes. Such a request could previously remove and recreate an existing device, then leave its security permissions unset when the attempted setup failed.
The driver now accepts these requests only from a known controller while it is idle, and refuses requests targeting the controller itself or the sender. It also avoids adding an already known device through proxy inclusion unless that device has just announced itself as part of the same pairing process.