In 4.6, we wanted to drop some default capabilities from the capability set to better secure the platform. However, we didn't want to break existing workloads on upgrade. We came up with a solution where we'd create an MC on upgrade that would add the old default capabilities: https://github.com/openshift/machine-config-operator/pull/2050. However, it seems we never really documented we did that. There were a couple of other similar changes https://github.com/openshift/machine-config-operator/pull/3352 and https://github.com/openshift/machine-config-operator/pull/3563 

100%

1. Check documentation
2.
3.

we don't mention we've done this with machine configs on changes that potentially risk upgrades

we should mention them