Relying on $function is a risk due to its deprecation path, but at this point MongoDB does not have a plan to eliminate it in any version. When that happens, we would have 30 months of support for it in MongoDB Atlas. Thats a lot of runway to implement around the deprecation then start using newer versions of MongoDB in Atlas.
Also note that $function is implemented into MongoDB Server, meaning you have full control over whether the feature exists by choosing your MongoDB version. Lets say its deprecated in 9.0. Fine. I’ll self-host MongoDB 8.0, stop using Atlas, and be able to still use this feature in the long term. This isn’t like other features in MongoDB Cloud, where it can be deprecated and force a much more disruptive change to happen. You have to weigh the pros and cons, a major con with this approach is being stuck with an old version of Mongo.
It seems weird to deprecate something that is already implemented for security/technical reasons. Couldn’t a flag be provided for customers that want it, and disable it for those that are concerned about security?