When InternalStreamConnection checks whether the command contained in bsonOutput (the encoded message) is in SECURITY_SENSITIVE_COMMANDS, it calls message.getCommandDocument: https://github.com/mongodb/mongo-java-driver/blob/a461dbabc338fefb8e003c1b30112174a3e99791/driver-core/src/main/com/mongodb/internal/connection/InternalStreamConnection.java#L481. While this method tries to avoid actually decoding bytes as much as possible, sometimes that is unavoidable (see https://github.com/mongodb/mongo-java-driver/pull/1456#discussion_r1691968763).

We can optimize these checks by introducing quite a trivial method that only decodes the first BSON key from bsonOutput, taking into account that BSON starts at message.getEncodingMetadata().getFirstDocumentPosition().