Context

Collection.UpdateByID builds the filter {_id: id} from its id argument without changing it. If id is a document containing query operators, for example {$gt: MinKey}, the server evaluates it as a query instead of matching it as a literal _id. This is clearly documented behavior for collection.UpdateByID:

This is equivalent to running UpdateOne(ctx, bson.D{{"_id", id}}, update, opts...)

Definition of done

Update the quote to this:

// This is equivalent to running UpdateOne(ctx, bson.D{{"_id", id}}, update, opts...),
// where id is used as-is in the filter. If id is a document containing query
// operators (e.g. {$gt: ...}), it is evaluated as a query rather than matched as a
// literal _id. When id is derived from untrusted input, applications should
// validate it or use a non-document type (e.g. bson.ObjectID or string).

Pitfalls

Not investigated