McAfee agent doesn't check what repository server contain the latest DAT files but contacts the repository in the way you selected in McAfee Agent repository policy so if the repository contacted is not up to date VirusScan will not update as well telling you no new updates found.
For example if you selected McAfee agent should contact repository by ping time it contacts the repository with faster ping response and if that repository doesn't contain the latest DAT file it will not switches to another repository but it will tell you no new updates found. It switches to another repository (in the order and way you have chosen) only if repository isn't reachable.
That is correct. You can configure which Repositories are available to each group in ePO and how the repository should be contacted. If an update is NOT replicated/present in a repository successfully reached, it assumes there is no update available. That is why it is important to monitor the repositories in ePO and even add alerts to let you know when a replication has failed. Such a failure can cause systems in your tree to not get updates even though they were available from the McAfee site.
The agent checks the sitestat.xml file on each repository. Once you replicated and the xml file was updated, the agent compared the catalog version referenced in the file to its own, validated that it is newer and could then perform the update. As far as I know this portion has not changed from 3.6.x to 4.0.