There’s no best really, but in my experience I prefer Hasura. I think their security model makes more sense than row level security and I prefer GraphQl.
You should try both and see
You should try both and see
As for your preference for Hasura security vs Postgres' native row level security, of course your preference is entirely valid and may also be the best fit for your needs, but consider that RLS works for all database clients, not just Hasura, so if you have a heterogeneous db client environment and you want to enforce one central policy, RLS can do that but a Hasura specific policy checker can't.
Disclaimer: I work at Supabase but not directly on the GraphQL support.