A Firebase app usually talks to the database straight from the browser or phone, with no server of your own in between. That means the configuration in your app, including the Firebase API key, is public, and the only thing standing between a stranger and your data is the rules file. Rules match a path and state a condition, typically based on request.auth, the signed-in user.
Firebase's own documentation lists the common insecure patterns. Open access, where read and write are allowed if true, lets anyone who guesses your project ID read and delete everything. Test mode is an open configuration meant for development and is not safe to deploy. Rules that only check that a user is signed in are also too broad for most apps, because any person can create an account and then read every other user's records.
Write rules so that each document is tied to its owner, for example allowing access only when request.auth.uid matches the user ID in the path or in the document. Validate the shape of incoming data, keep admin-only collections closed to clients, and test with the Rules Playground or the emulator before every release.
match /users/{userId} {
allow read, write: if request.auth != null && request.auth.uid == userId;
}