This is observed on 4.0, but I imagine applies to 4.4 and 4.2.

The oplog truncater thread checks for readonly, but not for recoverFromOplogAsStandalone. At startup with recoverFromOplogAsStandalone, the node will open WT in read+write mode and perform replication recovery. After replication recovery, the readOnly flag gets flipped to prevent external users from doing writes.

Because the readonly flag is flipped after the oplog truncater thread is started up, the truncater thread can attempt to perform a write that will fail.