Hi,
I cannot reproduce this issue using MongoDB 3.6.9 with auth enabled.
Can you check that you are definitely connecting to an arbiter via:
mongo --host ... --port ... --eval "db.isMaster().arbiterOnly"
The arbiterOnly result should be true if you are connected to an arbiter.
Arbiters do not replicate any data (including user/auth data), but another possibility is that someone has manually created users to secure your arbiter.
Regards,
Stennie