You could either do away with the model of the frontend writing to the DB and ask customers to implement a small backend with a serverless component like AWS La

You could either do away with the model of the frontend writing to the DB and ask customers to implement a small backend with a serverless component like AWS Lambda or Google Cloud Functions. Barring that, perhaps Firestore could introduce the concept of a "lightweight database function hook" akin to Cloudflare workers that runs in the lifecycle of a DB request, thus formalizing the security requirements specific to the business requirement and causing the development organization to allocate resources to its upkeep. So while a security rule usually gets tested very lightly, you'd see far more testing in a code component like the one I'm suggesting.