@Noam_A1 

In short, not a lot really

Sometimes the newer one is a tad faster, but usually not.   The versions are just small changes in chipsets and design as time progresses, recently its been exasperated due to chip shortage which means newer versions quicker with different chips

Personally I go for the newer, 3 or 4 in your case but it's not critical 

Over the years my impression is that the hardware version of vendor devices change mostly because of component availability (ie, lack of availability) or because a component may have a hardware bug (they would never tell us that unless they had no choice).

They aren't meant to improve anything, they just allow the model to continue to be manufactured and sold to the public.

The down side for the company and customers is it usually means a slightly different firmware (since there's are one or more different hardware components that likely need to be programed a little differently) which means another model to support with firmware releases which often leads to problems with release availability for older hardware revisions.

This is out of our control and, to a large extent, out of TP Link's control since they wouldn't release an additional hardware revision unless they had to because of the increased maintenance overhead.

  @Noam_A1 late 2023 Firmware and mobile app upgrades are huge improvements to features and ability to configure Deco X20. For example, you can turn off providing DHCP service for access point mode - avoiding conflicts with DHCP service provided by main firewall (and possible eventual subsequent crashes of routers etc).

The one BIG disappointment is that access point mode is still not fixed to act as a simple media bridge to an existing wired network segment. While Guest WiFi appears to work, clients logging into the unrestricted WiFi SSID  still act like Guest logins.  Which reveal that Deco X20 is still acting as a gateway connected to a WAN when set to access point mode. Thus all local subnet traffic is expected to pass to/from the firewall gateway ... and is thus killed. So Guest SSID or not, WiFi clients can only connect to Internet. Although passing local traffic through an Internet relay server could work, its not fast, secure local traffic.

But you can still kludge things with explicit Gateway mode if your main firewall works in double NAT configurations where WiFi is setup as its own subnet. Doing that you can configure the main firewall to route WiFi traffic back onto your original wired subnet. Just a big flood of unnecessary "around the block"/"Chinese Fire drill" traffic burdening your main firewall. But hey! you got double firewall protection on WiFi machines!!!