If I create a web app with the serverless client-firebase model, it seems almost 100% my data structure, comprises of nodes, subnodes, duplicate nodes and key:values, is exposed by those DB ref URLs, CRUD and atomic update functions from client js code .
I am not saying that I am not gonna put DB rules, but to only question that exposing so much info which client does not need at all, is it beneficial to hackers only?
I am thinking of create a REST API in the middle and hide firebase queries, but this somehow against the serverless idea. is Cloud Functions for Firebase a cue here?
P.S. I have read related questions below, but they are not the same.