From reading rs_initialsync.cpp, it appears that there is no setting to ensure that new replicas do their initial syncs from secondaries. While you can fake it by e.g. setting up iptables rules dropping packets to the primary when the initial sync server selection happens, it'd be great to be able to just frob a setting to ensue this behavior.