accessing firestore collections

I'm here to firestore, I like the way you can easily integrate the collection into your client application.

At the moment, I'm accessing my collection directly from vue store like this:

async createPost({ state, commit }, post) {
  await fb.postsCollection.add({
    createdOn: new Date(),
    content: post.content,
    userId: fb.auth.currentUser.uid,
    userName: state.userProfile.name,
    comments: 0,
    likes: 0
  })
}

Is this secure? Because the database is exposed directly to the client-side. As a result, unauthorized data manipulation might occur. Should I move the database operation into something like an express API, so database operations are done only on the server-side? All the examples and documentation I found have everything on the client-side and the databases are protected with security rules.