This thread is about this specific app/idea/team. It is not about potential security problems in general. The parent could have just asked "what is the security and privacy?" rather than make baseless assumptions and accusations. So no, it is not a fair critique without more information and I don't see how an article about unsecured Firebase databases is related given the current information. I can give you a similar article about unsecured, internet accessible Elasticsearch servers, but does that mean the ones I run are unsecured? You could assume that if you want but that would be an incorrect assumption.