Seems this is by design per Jeff Brown jira
The data binding explicitly avoids binding id or version [if] they both exist and does this by design. This is a shield against potential security problems relevant to data binding as it relates to domain classes. A simple work around for command objects would be to name the properties with something like "idValue" and "versionValue" or anything other than "id" and "version".