I see it as an opportunity to educate the builder community on importance of using the provided security tooling. What I'm asking users is to use tools while building. Our tools explain security in business terms and give people tools to bridge the technical gap. Is it always enough? No, there's no perfect tool or approach, there will always be space to improve. But as you can see, if apps continue to expose the data, the actual blame falls on us - and there's no intention to say. And we are taking it as an input to improve our tools, UX, auto-fix tooling, user messaging and have more ways for users to build secure apps.
I find this theory really odd. Wouldn't it make more sense to flip it around and have it maximally locked down from the beginning? You're providing essentially a Supabase abstraction. Why not make the abstraction secure from the beginning?