There are a lot of FLE tests use assertEncryptedCollectionCounts to perform checks and this check can be performed against a secondary if the test passthrough changes the read preference to secondary/secondaryPreferred. However, reading from a secondary can return stale data and since FLE clients are not working with causal consistency, it's not guaranteed that the assertEncryptedCollectionCounts will check against the latest data on the secondary so they can fail on secondary.

From a previous discussion, these tests should have the tag "assumes_read_preference_unchanged" so they won't run against secondary.