we have an extensive system prompt to instruct the Supabase to follow RLS best practices: https://github.com/dyad-sh/dyad/blob/de2cc2b48f2c8bfa401608c...

What you're describing as the fail-open behavior is from the Supabase platform (and not specific to any app builders): https://supabase.com/docs/guides/database/postgres/row-level...