Since release 1.4.0 secure boot and flash encryption are now part of the firmware delivery. For more details, please see https://github.com/sg-wireless/sg-sdk/blob/main/docs/SECURITY.md

You can reset the devnonce on TTN (or even set it to be ignored). Go to the end devices section on TTN, open the end device affected, go to settings and scroll down all the way to join settings and click expand.

image.png

The devnonce is stored in the nvs partition, which is normally not erased when just flashing a firmware update. But if the board is erased completely then the last devnonce used is also erased.