https://docs.mongodb.com/manual/core/replica-set-arbiter/#security

Clarify that the authentication behaviour refers to inter cluster communication only and not to clients/users authenticating to the arbiter.

Perhaps add the correct behaviour for clients connecting to an arbiter in a replica set using authentication and authorization.