[CiPHPerCoder]

Oh, this did seem familiar!

The AES-CBC thing is tied to the key, right? So the downgrade attack isn't possible.

[xxkylexx]

Yes, new account keys are identified (presence of a mac key) and block the downgrade (see code link above).