Preferred and typical use of MongoDB is with no javascript in the queries. There really is a huge reduction of risk for this one particular attack.