Is it dangerous to expose MongoDB's db.collection.find to users?
The real answer is it depends, but most of the time this probably isn't a good idea. SELECT while it is less nefarious than other the other CRUD commands still carries risk.
Why this is probably a bad plan

Most applications with databases have some concept of an authenticated user vs a non-authenticated user. If I have unrestricted SELECT only access to the database I can find your hashed passwords and brute force the password offline.
I can mine your database for your user's contact information to let them know about my buddy who is an African prince with a problem accessing his funds.
I can DDoS your server by crafting long running queries and repeating them every timeout.
I can create lots of memory intensive queries to drain resources as well
I can scrape your data and use it for my own profit.
I can increase your bandwidth costs by repeatedly requesting large amounts of data
And many more things

It is important to note that even sites like Have I been pwned? which offer unauthenticated searches of large semi-public data sets don't allow unrestricted SELECT capabilities.