tl;dr:

• Monitoring-only sockets must not send SCRAM mechanism negotiation in isMaster and must not authenticate at all.
• Non-monitoring sockets (e.g. connection pool or single-threaded client) do a "normal" handshake and authenticate if there are credentials.
• An authentication error on a socket must close all (and only) non-monitoring sockets to the same server.

Possible backward breaking change:

• Some drivers were resetting a server's topology description to Unknown on an authentication error and should stop doing so. This means the topology will always be "correct" even when authentication fails.
• It will no longer be possible for authentication errors to be masked as server selection errors.

Detailed changes:

• https://github.com/mongodb/specifications/commit/df4bc0b3224befda92af7a0bdfd10183deae29df
• https://github.com/mongodb/specifications/commit/64ddab6b40e78aed2f7d2134195c04e382837eb3