... no one is pointing fingers at MySQL, like they are at MongoDB, as if this is some kind of security flaw in MongoDB.

It's a feature, not a bug. The docs make it clear that $where can run JavaScript, so if you know what you're doing, you're not going to allow JavaScript to flow through your software as if it's valid input.