It’s not a vulnerability in Firebase, setting aside the question of whether it’s a Firebase “problem” (ie how the blame is divided).

How is it true that apps using Firebase “rarely” secure it properly, if only 10% of apps using Firebase are vulnerable?

A lot of mobile apps are very poorly written.