Can you use a 50 A GFI spa box on a 40 A circuit?

Yes, that’s totally fine.

Because the spa box is downline of a 40A breaker, it could be a 400A spa box for all it matters; it won’t be able to draw more than 40A.

I bet your car has 112 mph tires. That doesn’t mean you have to actually drive 112 mph :) The panel limit is just an absolute max, like a redline. You can feed a 125A panel off a 60A breaker etc.

That’s why they don’t make 40A spa panels; there’s no need. 50A spa panels cover the necessity.