All of the things you mention have flat or very simplistic security systems. In other words, access is predefined. X can do Y. That's not how high-level softwa

All of the things you mention have flat or very simplistic security systems. In other words, access is predefined. X can do Y. That's not how high-level software design works. You're at the top of the chain. The security that you engineer will vary based on the very content that's being accessed! Just because you're a user with the right password doesn't mean squat. Facebook is a fine example. Just because you can view the profile of one of your friends, doesn't mean I should be able to as well. I'm not his friend. How do you define that in Firebase? if(you_are_friend) allow_access? What the hell is a friend? How does Firebase know what a friend is? Now you're setting up complex rules that access multiple databases/tables/rows just to make a decision. That mountain of code that manages the core operations of your software can't be wished away by happy thoughts.