I'm guessing that spamming invalid request on all of firebases customers endpoints is the most efficient way to deal with the whole ordeal... If a large enough customer base gets the problem they'll have to act... Unless they can happily close up shop because Google owns them... Ah well :(