Your Firebase app will only have access to data in the database that the rules permit. Security is handled by the Firebase Realtime Database (not the app) so only data that the user is allowed to access will be downloaded.
In order for your app to work with data stored in the database, it needs to be downloaded to the device. By default, data is cached so that your app still works even if your device temporarily loses its network connection. The app only stores this locally if you enable offline capabilities to allow the app to continue working when no network is available.
Firebase apps automatically handle temporary network interruptions. Cached data is available while offline and Firebase resends any writes when network connectivity is restored.
When you enable disk persistence, your app writes the data locally to the device so your app can maintain state while offline, even if the user or operating system restarts the app.
The Firebase app will automatically handle all of this functionality for you.
The size of the local cache will rarely be large enough to worry about, unless you are storing or downloading huge amounts of data, which is not recommended. If your database is large, you should implement strategies to restrict queries to only retrieve relevant data by filtering or paginating your queries.