The file_metadata endpoint has a query parameter called source_permissions with possible values ignore, use, or use_when_creating.
The 3.x agent and master defaulted to use, but this changed in 4.x to ignore. In addition, 3.x agents "rely" on this default value matching on both sides and therefore don't bother specifying a value when making requests.
This is problematic for 3.x agents talking to a 4.x master, as the default value has changed and the agent doesn't explicitly specify it. For comparison, the 4.x agents explicitly specify the value when making the request.
This behavior will break external executable facts (they won't be executable on the agent) for 3.x agents talking to 4.x master.
We should modify the legacy_routes_service to reconcile this difference and append source_permissions=use to file_metadata requests made to the old URLs (unless of course it's already specified, which agent 3.x agents won't).
We already have failing acceptance tests in CI for this: https://jenkins.puppetlabs.com/job/platform_puppet-server_integration-system_no-conditional_puppet3-compat_master/18/