The "$_backupFile" aggregate can be used to download all the data from a mongodb instance, if a backup is in progress. While it does require the user know the backup id, it would be best if it also required privileges. The "exportCollection" privilege for all collections should be appropriate.