Currently, mongosh reconnects after "rs.secondaryOk()" (and perhaps others) is executed. Technically, it doesn't need to reconnect to the server for this.
The reconnections make using the Okta LDAP plugin more difficult with mongosh, since it needs to fetch a new MFA whenever mongosh reconnects to the server. Ideally, mongosh would use one connection and never reconnect it, when used with maxPoolSize=1.