Is there a low-code backend/full-stack which is secure by default? I remember some clunky UI to define filters and projection in Firebase. Can a Django/Laravel app weekend project get there before Supabase?
It has it's dangerous spots, and it's uncomfortable spots, but we pretty much know all about them already, and usage is heavily documented.
Or you can try ORM74 and hope it is faster and more secure than THE standard way. Gamble away.
Or maybe try Framework 74b which abstracts away the ORM
That said, all of the full fat frameworks make it pretty easy to define what should and shouldn't be visible to what users, the use case that he has would not have been harder to do using rails, phoenix, django, etc as a backend, and it would have been very easy to control the failures that he had.