This reminds me of the old MongoDB 'issue' where MongoDB was accused of being insecure because developers failed to secure their database instances properly.

Aside from that, Firebase has learned from their pre-aquisition time and now sets all new DB instances to locked.