if a replicaset member goes down during a $out we are left with an inconsistent state

If you kill a server during $out you well end up in one of two bad states.

If it's the primary you kill, the secondaries are left with the tmp collections.

If it's a secondary you kill, that secondary will drop the tmp collection when it restarts and then continue building the tmp collection as it reads the primary's oplog. As a result, the entries written before the reboot are absent from the output collection once the aggregation has finished.