Correct. We suggest using Postgres Row Level Security if you use the Supabase APIs + Auth: https://supabase.com/docs/guides/auth/row-level-security

You don't have to use RLS if you BYO middleware, but the RLS approach give you the option to do `frontent <-> backend` (vs `frontend <-> middleware <-> backend`)