I found a few server parameters owned by Replication that are intended to be used for testing only but do not use the test_only:true option, this means a user could potentially enable these commands without having enableTestCommands:true set

enableDefaultWriteConcernUpdatesForInitiate
testingSnapshotBehaviorInIsolation (looks completely unused)
disableLogicalSessionCacheRefresh

This list may not be exhaustive so a closer look at other parameters is recommended as part of this ticket.