Another approach would be to limit the RFR functionality specifically to tables that have a PK. The decision to lookup/not lookup is done in sql/log_event.cc::decide_row_lookup_algorithm_and_key where it checks to see if an event is WRITE/DELETE/UPDATE ROWS and handler->rpl_lookup_rows(). I think adding another predicate there to test for a PK is a reasonable preventative along with clear documentation on the behavior.
Another approach would be to limit the RFR functionality specifically to tables that have a PK. The decision to lookup/not lookup is done in sql/log_ event.cc: :decide_ row_lookup_ algorithm_ and_key where it checks to see if an event is WRITE/DELETE/UPDATE ROWS and handler- >rpl_lookup_ rows(). I think adding another predicate there to test for a PK is a reasonable preventative along with clear documentation on the behavior.