The deserializer purposefully ignores extra fields encountered in a document when deserializing a struct. This behavior was added long ago before serde's derived Deserialize implementations did this by default. Nowadays, this is done by default, and users can specify a deny_unknown_fields container attribute to disable it. Because the BSON deserializer ignores unknown fields always, this attribute has no effect when used for decoding BSON.

e.g. the following should fail but doesn't

#[derive(Deserialize)]
#[serde(deny_unknown_fields)]
struct Cat {
    a: i32,
}    
let doc = doc! {
    "a": 1,
    "b": 2,
    "c": 3
};
let cat: Cat = bson::from_bson(Bson::Document(doc)).unwrap();