When you say 'game that runs on the client' -- I'd clarify that you're talking about the authoritative game logic.

Ie most multiplayer games ship the same physics code on client and server, but the server is the authority.

That kind of game is clearly impossible with Firebase, but depending on the expressiveness of the validations, there might be ways to prevent cheating.

    allow update of y_pos IF jump.pressed 
    AND not jump.wasPressed 
    AND new.y_pos - old.y_pos < 3 
    AND old.was_on_top_of geospatial( world_geometry, entities)
    AND new.not_inside geospatial( world_geometry, entities)