Firestore exemple with a potential vulnerability

https://github.com/firebase/quickstart-js/blob/519575991b4737eb856b9c202c3b2e387584c912/firestore/scripts/FriendlyEats.Data.js#L86-L89

I know this is a simple demo app, but I think this should be stated that this kind of pattern should not be used in a real world app, since the client could easily hijack the number and average of ratings.
I think this is where cloud functions should be used to proceed with the calculation.