This is essentially the #1 Firebase footgun. Having client-accessible databases with optional rule-base security has always seemed a bit dumb to me.