As part of SERVER-49117 it was attempted to remove the validation on the _id field guaranteeing that $-prefixed fields should not be allowed:
https://github.com/mongodb/mongo/commit/995f0406d72b1a15d18b2df2d8c0afa0c4c5b774#diff-5295b5000db7b3711a31f86ebbe374e929270da88b36b20d3459c9b1d4f48d17R135-R136

However, this caused a failure in a fuzzer test: BF-21074

The cause was that while this validation was removed on document inserts, when a subsequent update is made and written to the oplog, the generated update request follows a path that still enforces the validation that _id cannot contain $-prefixed fields, which results in a uassert being triggered.

Relevant code: https://github.com/mongodb/mongo/blob/master/src/mongo/db/repl/oplog.cpp#L1360-L1366

This path on inserts may potentially experience the same problem if we remove the validation on _id:
https://github.com/mongodb/mongo/blob/b06cffeabf1d6152f3cf722efb07a144480d3917/src/mongo/db/repl/oplog.cpp#L1302-L1316

Subsequently, removing the validation on _id will need to fix the first and possibly also the second path mentioned above.