Answer
From 23R1 GA onward, some client-side errors (malformed requests, incorrect URLs) do return an HTTP 4xx status, a change from 22R2 and earlier where nearly everything (formatting problems and business-rule validations alike) came back as HTTP 500. However, errors raised specifically via Error_SYS.App_General (the general-purpose business-logic error-raising mechanism) still come back as HTTP 500 regardless of version — App_General is used across too many different scenarios for IFS to generally classify those errors as client-side (4xx) issues, so business-validation errors raised this way will keep returning 500 even on current versions.