Comment by simonw

I found this story about the same situation (linked from the OP) easier to follow: https://saligrama.io/blog/post/firebase-insecure-by-default/