When connecting to a replicaset passive secondaries are not counted when obeying `secondaryOnlyConnectionAllowed`. In replset_state.js in mongodb-core if the server is passive it doesn't check to see if `secondaryOnlyConnectionAllowed` is set and true, it only does that for non-passive secondaries. There doesn't seem to be any reason why a passive secondary wouldn't be allowed to be the only connection.

Also, the info log is incorrect for non-passive secondaries, it still says "promoting to passive" instead of "promoting to secondary".