Others have pointed out that this is more about Supabase than it is about "vibe coding." As someone just learning to use Supabase myself, the 2 biggest pieces of advice I have are:
1. Put anything that you don't want to be accessible by anon in a schema other than "public." This seems obvious, but the public schema is Supabase's default behavior. Supabase's official reply about this question is "I guess you can, but don't worry, RLS." However, security is an onion. Put up as many barricades as you can. If I was king of Supabase, I would err on the side of security.
2. Login to Supabase Studio, set your role to "anon" instead of "postgres" and click on every single table and view that should be private, and make sure there are no results.
Supabase could do a lot better about communicating this, and it would require no breaking changes unlike this disaster[0] which requires hacking your historic migrations!