I see that there is no way to set security rules as preventing "delete and update" for a child.
".write": "!data.exists() && newData.exists() && !newData.exists()"
thats not make sense.
See Question&Answers more detail:
os 与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…