In schema delta 35, synapse added an entry into the device_max_stream_id table (https://github.com/matrix-org/synapse/blob/develop/synapse/storage/data_stores/main/schema/delta/35/device_stream_id.sql). Full schema 54 has now been cut which means this schema delta file isn't being run for new installs as of 1.0 (when full schema 54 was released) so it looks like these synapse installs never get an entry in device_max_stream_id. It's written to by an UPDATE clause so no entry is created if one doesn't already exist.

It doesn't look like it gets created anywhere else. If not, this means the device stream token resets any time synapse is restarted which causes to_device messages to go missing, causing Unable To Decrypt errors.

Same bug may apply to appservice_stream as that appears to do the same thing