This changed with the 3GS, where Apple began issuing signatures for individual devices to authorize firmware installs. This procedure is also in play for the 3rd generation iPod Touch, iPhone 4, and iPad.
The firmware install process includes a phone-home procedure that verifies with Apple that the device is authorized to install that firmware.
Once a new firmware image is released, Apple just stops issuing signatures for the previous releases and devices can no longer install it.
The procedure is vulnerable to a replay attack, and so Cydia offers a stand-in replacement for Apple's authorization server, but users who want to downgrade have to be savvy enough to save their auth token ahead of time.