I have to say I am not a big fan of calling a cloud that in turn calls Firebase. On paper its great, however in practice not so much, at least from my point of view. The critical aspect of this solution is the amount of latency that is being added, and on top of that every request has double the chances of failing, therefore such actions need to be carefully crafted in order to handle failures gracefully as otherwise you application may halt to a standstill. There is nothing wrong with doing your best to tighten security and following best practices, however if your application handles sensitive data, personally I would recommend to build your own backend because at the end of the day every BaaS is pretty much a blackbox.