Using Application Default Credentials / Service Account with Firestore on GCP

I have a simple server-side request to Firestore, that works locally using ADC, like so:

import Firestore from '@google-cloud/firestore';

const db = new Firestore();
const ref = db.collection(COLLECTION_ID);
const snapshot = await ref.orderBy('enabled', 'desc').get();

I am getting this error PERMISSION_DENIED: Missing or insufficient permissions when deploying to GCP, even with the following rules:

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if true;
    }
  }
}

I have also tried with firebase-admin but I get the same error when deploying:

import * as admin from "firebase-admin";

// initalize firebase
if(admin.apps?.length === 0){
    admin.initializeApp({credential: admin.credential.applicationDefault()});
}

const snapshot = await admin
          .firestore()
          .collection('MY_COLLECTION')
          .orderBy('enabled', 'desc')
          .get();

Why would this be happening?