On 8.0 and 8.1, Mongoid::Contextual::Memory#distinct reads
field values with doc.send(field) when the deprecated legacy_pluck_distinct
option is enabled:

def distinct(field)
  if Mongoid.legacy_pluck_distinct
    documents.map{ |doc| doc.send(field) }.uniq
  else
    pluck(field).uniq
  end
end

This is a security concern as it allows arbitrary method execution (e.g. distinct(:destroy)
will invoke destroy on each document rather than reading a field – not good).