How does this handle permissions over data? I wouldn't want a user accessing private information of another. How would you "hide parts of a table" to a client-side reader?
If you recall from the SQLite story, it was created, in-part, to provide a local cache to an offline device yet still have the same query interface that developers enjoy. Because the model of access is shifted to the device, anything you populate a client-side SQL database with is already data that is accessible by the client.
Unless the developer adds synchronisation primitive to sync data between multiple clients all data are local.
I agree with the other commenter though that by putting a DB on the client, you’re implicitly trusting that client more than usual to only make acceptable changes to the DB. If you’re working in a sensitive context, I think Local First means you’ll have to spend some extra time planning out data security