Yes my apologies for not making this clearer in the original announcement. There are packages for cstruct-lwt, cstruct-async, ppx_cstruct and cstruct-unix that are version .0 for the old (pre-3.0.0) versions, and act as dummy packages that pull in the dependencies. This should make it safe to just add them as dependencies without any fancy constraints.
However there is one failure mode that I just fixed in (for example) tar-format: https://github.com/ocaml/opam-repository/pull/9432. If a package assumed that including cstruct and lwt in its ocamlfind requires list was sufficient, this used to work since Cstruct_lwt was in the same subdirectory as Cstruct. With Cstruct-3.0 (and newer releases that use Jbuilder like Ipaddr and Uri), there is more hygiene in the installation and the separate packages are now in subdirectories, so this will no longer link. The solution is to explicitly link to cstruct.lwt in the ocamlfind requires list. This is also backwards compatible with older releases, but requires a new release of the offending package to work with newer Cstruct.