> Services like this should simply not function at all until basic things like a password are put in place.

New Firebase instances starts off locked down by default, not allowing global reads or writes.

The fact that this was not the default since the inception of the service is inexcusable. Sadly, too many other projects still take the approach of yelling at people in some document somewhere instead of forcing security by default.