Q:

Firestore security rules and custom claims - can uses overwrite them?

I want to use custom claims in my Firestore security rules but I read that they can apparently be overwritten by users:

However, if the same custom user claims are defined on a user signed
  in via custom authentication, the overlapping claims defined in the
  custom token have higher priority and always overwrite the custom user
  claims defined on a user via this API.
  [https://firebase.google.com/docs/auth/admin/custom-claims][1]

Which defeats the purpose, so I guess I must be missing something?
EDIT: moved extra question to another post

A:

A user cannot set custom claims on their own account. The only way to set custom claims on a user profile is through the Admin SDK, which requires that you have access to the project credentials of the Firebase project, something only collaborators on that project do.

