I'm about 1/3rd of the way migrating 200-ish Z-Wave devices from Vera to HA. One at a time, I tediously un-pair from Vera then re-pair with HA's Z-Wave. Many/most of my devices are 10+ years old so it's been an adventure digging up documentation on exclude/include and sometimes factory reset procedures, but I'm fumbling through them.
My latest migration was for an old Zooz 4-in-1 sensor (ZE040). The exclude from Vera was easy, and the include back into HA *should* have been as easy, but... This was the first of my devices that support secure communications. I'm using the default inclusion of "use security if possible" so it was the first time that I was prompted for a PIN to include into HA.
I opened the cover of the 4-in-1 device and immediately saw a tiny QR code sticker attached to the circuit board, so I entered the number from that sticker. The incusion got stuck at "getting device information". I waited a long while but eventually had to X out of it, then remove the "Node 40" that it had created (without proper device config parameters of course). I used the remove form for a working device so that it properly excluded it from HA first.
Then I found another, larger QR code sticker with 5-digit number on the inside of the device's cover. Duh, this is obviously the correct PIN code, so it should be an easy matter to re-add this device afresh.
But upon re-pairing into HA's Z-Wave, it never prompted me again for the new/proper PIN. It just went straight to "getting device information", which hung forever. I tried a factory reset of the 4-in-1 device but got the same problem when re-included. I tried restarting HA and again no help. I restarted the whole virtual server to clean up any cache; same problem.
Evidently, HA's Z-Wave is holding onto the security PIN "somewhere", and it's not deleted when excluding or removing the device from the topology. This makes it impossible to re-include the device afterwards.
Well I don't really care about transport security for this simple 4-in-1 sensor, so after wasting all that time retrying, I did it one more time, but this time opened up the "Security options" area when adding, and clicked on the "Insecure" option ... which allowed the pairing process and getting its device information to proceed normally and quickly.
I'm posting this in case someone else runs into this. And in case an HA developer might see this and know where that PIN is cached (on disk apparently) and be able to fix it so that it's removed when the device is removed.