Comment by qwertox
> including moving off Firebase
Firebase is not to blame here. It's a solid technology which just has to be used properly. Google highlights the fact that setting up ACLs is critical and provides examples on how to set them up correctly.
If none of the developers who were integrating the product into Arc bothered about dealing with the ACLs, then they are either noobs or simply didn't care about security.
Saying Google provides examples of being rather nice about it.
Firebase ACLs are a constant source of vulnerabilities largely because they are confusing and don't have enough documentation around them.