Yes it is a security issue. But almost everything is. You can make it secure enough with the right policies. However it overall increases the attack surface of your application and has a greater chance that you missed something or miss configured the policies. So many firebase apps have been hacked because of miss configured access to the database.
So it puts more work on you to get things right.






No. But only because I switched to helix. I have used vim for a lone time before that. Only having vim on a system is fine. Far worse is only having vi. Which is almost like vim but missing a lot of useful things.