> [RLS]… planner goes haywire and does per-row-matching

Er… yes? It’s called Row-level security; how else are you going to validate that a row passes a policy?