Firebase used to be open by default, (to ease the dev experience, presumably), but sometime around the Google acquisition became private-by-default. It also warns you incessantly when your security rules are too open.

I suspect (hope?) most of the apps still using it insecurely came from before the acquisition by Google.