What is the intent of allowing arbitrary document assignment to any other global user in the system, with zero default security checks in place? That seems like a fundamentally terrible idea. Other sharing systems require explicit steps to share documents between users (sharing a Google doc with an email address, for example), and it's a very controlled workflow. In Firestore, user IDs are global, and you can arbitrarily give them data? Even if you can get around this with specific security rules, why is this even a thing in the first place?