As far as I know, none of these keys (except the email/password) are considered a secret. The real problem here is that they aren't using Firebase/Firestore rul

As far as I know, none of these keys (except the email/password) are considered a secret. The real problem here is that they aren't using Firebase/Firestore rules to correctly limit database access.