macOS actually comes with Bash 3.2, which is from 2007. it is the last version released before they switched to GPL. this is actually why they switched to zsh.
Well, the fact is, the version available on opensource.apple.com in macOS 11.0.1 is 123.40.1 and the version in 10.15.6 is 118.40.2... and they slightly differ.
Interestingly, the new version removed the dependency on the unavailable rootless.h header, making it (probably) buildable out of the box, now.
I would assume the version difference is from Apple updating it internally. They don't run into GPL issues unless they pull from newer upstream Bash code.