Custom check for verified email address is failing in Firestore security rule

Question

I have some simple rules set up to check if a user can create or delete a certain profile document.

service cloud.firestore {
  match /databases/{database}/documents {
    function isSignedIn() {
      return request.auth != null
    }

    function isOwner(userId) {
      return request.auth.uid == userId
    }

    function isVerified() {
      return request.auth.token.email_verified
    }

    match /profiles/{profileId} {
      allow read;
      allow create: if isSignedIn()
                    && isVerified();
      allow update,
            delete: if isSignedIn()
                    && isVerified()
                    && isOwner(request.resource.data.userId);
    }
  }
}

The check for isVerified() in the update part of the profiles collection fails...even when the logged in user has a verified email address set.

Doing the following from within my app results in a security rules error:

profilesCollection.doc(currentUser.uid).update({
  name: 'Michael'
})

If I remove the isVerified() check on update it works. However, I definitely want a user to have a verified email address to allow this.

If I check the status of auth().currentUser.emailVerified it returns true. Only by logging out and back in again does it actually pass the security rule check. It's almost as if the frontend JavaScript app's verified status is not agreeing with what the Firestore server sees.

UPDATE:

This all happens immediately after a user creates an account:

async signup() {
  const createUser = await auth.createUserWithEmailAndPassword(this.signup.email, this.signup.password)
  await createUser.user.sendEmailVerification()
  this.complete = true
}

After signing up a user will check their email and follow the verification link.

Coming back to the app (and still signed in), emailVerified is false. auth.onAuthStateChanged() does NOT get triggered.

A "hard refresh" of the page shows that emailVerified is now set to true. Trying to create a profile document fails though...due to the isVerified() check, in the security rules.

Only by physically signing out and then in again can a user create documents, which is a little absurd.

So essentially, signing up and verifying your email does not update the status of the users email verification and even after a hard refresh still does not pass the security rules.

I can't understand why it works like this, if it's a bug...or something else?

Any help greatly appreciated!