Any tl;dw?
I suppose you can also setup rules as to what operations should be allowed from the clients, so you they just loop an insert to destroy the DB, but not much was said about security/auth etc.
I think he said they plan to release a first version in two months.
EDIT: Firebase is actually what he compares it to! But since I've worked a lot in meteor that's my first association :)
Fusion will ship with a security model -- it will absolutely not be insecure out of the box. This type of project would be pretty useless without security (beyond basic demos), and a security engine is an essential feature in v1.