Run MongoDB with Secure Configuration Options from the Security Checklist talks about disabling server-side scripting and enabling wire protocol validation of BSON documents, however that is not mentioned on either of the two pages that the section links to:

• https://docs.mongodb.com/manual/core/security-hardening/#mongodb-configuration-hardening
• https://docs.mongodb.com/manual/core/security-mongodb-configuration/