Firebase security rules are the access control mechanism of Firebase cloud databases, and their default basis for judgment is the requester's identity rather than payment status; they can only verify whether a user is himself, not whether the user actually paid, and the correct approach is to leave the writing of subscription status entirely to a trusted backend, with the client having only read-only permissions.