Comment by amelius

> You can use Firestore Security rules

I think the main problem is that they bolted security (access control) on top of their existing system, rather than make it an integral part of the design.