I don't understand what the 'version' column is for. You can get the sequence by just looking at the 'version_on' attribute. Deletes are already restricted on that table and it wouldn't solve concurrency issues since it's generated by the trigger.
If I think I'm updating version 2 of an entity, then only update that version, otherwise throw an error.
I've updated the post to address this scenario.
NEW.version := OLD.version + 1;
Is there a different concurrency issue I'm not seeing caused by updating the version in the trigger?
You still have the issue of someone setting the version explicitly in an update statement without a WHERE clause which checks for the current version. But I guess as long as you enforce not doing that it's fine.