When a secondary falls too far behind replicating (should be settable, probably at the replication set level), the secondary should automatically enter recovery mode until it catches up to prevent reads. This would help in situations were clients are reading off secondaries but cannot afford to read data that is too stale.
The drivers being able to specify max replica lag in operations would also be very powerful.