After acquiring the IX lock on the collection level we can use AutoGetCollection instead of AutoGetCollectionForRead: https://github.com/10gen/mongo/blob/c8f6bd7b917856060fdfb2d78dab17b734fc4848/src/mongo/dbtests/query_stage_collscan.cpp#L777-L778

AutoGetCollectionForRead acquires an IS lock which should be covered under the IX lock but oddly enough I ran into an issue with upgrading locks. Could be due to the way I was prohibiting lock upgrades described in SERVER-73040.