I want to know how secure Firebase is against the below-mentioned attack. App Modification - I know Firebase uses SHA-1, SHA-256 protection against Authentication, But if modified app bypasses the login process, does this also prevents attacks against read-write in both databases due to SHA. If the unencrypted data flow is accessed by an attacker due to CA certificates installed in the device. Can he change database queries?

Firebase security against modified APK and MITM attacks

I want to know how secure Firebase is against the below-mentioned attack.

App Modification - I know Firebase uses SHA-1, SHA-256 protection against Authentication, But if modified app bypasses the login process, does this also prevents attacks against read-write in both databases due to SHA.
If the unencrypted data flow is accessed by an attacker due to CA certificates installed in the device. Can he change database queries?