Our docs say:

Starting in MongoDB 3.0, an index cannot cover a query on a sharded collection when run against a mongos if the index does not contain the shard key, with the following exception for the _id index: If a query on a sharded collection only specifies a condition on the _id field and returns only the _id field, the _id index can cover the query when run against a mongos even if the _id field is not the shard key.

Either the docs are wrong, and queries on the _id index are not covered because they actually do fetch the full document through the IDHACK stage (rather than the normal FETCH stage) and do orphan filtering based on the shard key from the document.

Or there is a server bug that queries on the _id index are covered, but orphan documents are not filtered out.