You usually use a tool like fireward or bolt to manage schema for the security rules.

https://github.com/bijoutrouvaille/fireward

https://github.com/FirebaseExtended/bolt

I have seen people putting bad security rules often before. It makes me worried about using firebase apps.

No proper rate limiting, protected fields, dashboard sucks, opened feature requests for years without any answers, missing ton of small stuff I can't remember that is very easy to do on postgres (counters?), etc.

I have used hasura. It's good but I like supabase more now. Easier to directly write SQL than indirection of graphql.