You typically cannot trust the game client so either you'd have to submit the scores to your own backend and then forward to Firebase or perhaps use .validate rules as per:

https://www.firebase.com/docs/security/security-rules.html