They get bumped. When you publish a new NDA version, the old document is marked superseded and existing reviewers lose proxy access on their next request. They see the new NDA text and have to re-sign before they can access the prototype again.

Each consent is tied to a specific document version (with a SHA-256 hash of the content), so you always know exactly which version someone agreed to.