Currently we have at least two places (that I know of) where we rely on BsonDocument.clone returning not only a deep copy, but mutable deep copy:
1. AbstractConstructibleBson.newMerged
2. The new method ClientEncryption.createEncryptedCollection introduced in https://github.com/mongodb/mongo-java-driver/pull/1079.
ross@mongodb.com pointed out that RawBsonDocument breaks the "mutable" part and can come from users.
- links to