I have not written the software, I am only trying to help. And Yes It does matter if when it was updated. You are giving an 7 month old order as an example. If it has been indexed 7 month ago a new version will not stop this, because it seems like the password for the invoice is included in the indexed URL.
I asked if You can Do the same with new orders ? If the problem has been rectified, then there is only an issue for old invoices, not new ones.
Maybe someone else can give You more help
Jörgen @ Kreativ Fotografi