So I don't know if they had the site in test mode, or they simply set a rule to allow everything (I've seen that happen) instead handling access based on user permissions.
All with libraries in a lot of languages to make it easy. Pretty solid product with a cohesive experience and a generous free tier.
Naturally, you'll pay an exorbitant amount once you start to scale and realize you've been locked in.
Crazy giving up that much control of your product to a third party. I can definitely see the appeal to spike realtime/chat projects, though—they really leaned into that api design well. Selling out to google was a mistake.
As a product with a ton of appeal to the least experienced developers, lots of mistakes happen.
My understanding is that (assuming you trust google) there's no reason you can't build a secure application on firebase.