https://docs.mongodb.com/master/release-notes/3.6-compatibility/#compatibility-enabled doesn't list authentication restrictions as a feature which must be removed prior to downgrading. Because these restrictions are attached to persisted user and role documents, authentication restrictions should probably be mentioned in that list.