The underlying issue here is that Firebase was sold as the answer to the not-so-techy people that wanted to create apps but couldn't necessarily handle the backend and here the issue is that Firebase should have thought that the majority of the audience thought Firebase would handle backend security for them as well.

Yes, Firebase team messed up here, but technically speaking it's not too late to fix if done right now. I noticed Firebase already added big banners in Firebase dashboard to make people aware of this issue, or maybe it's a way for Firebase team to cover their asses by saying we told you so!! It's a good step towards fixing this issue but it's still not enough.