found via CI: #51629
If security is used and the transform user is a non-admin user _transform/_stats might return old state information after stopping the transform with wait_for_completion=true. The information is correct eventually after the index is internally refreshed via refresh_interval (1s) of the underlying lucene index.
Severity: Low, the problem only affects users(security enabled) that script transforms and rely on correct stats information.
Mitigation: Call _stats again if the expected output is wrong until the refresh has happened.