Firebase - Read-only security rules

Question

I put several images into Firebase’s Storage. Then I created a database in the Firestore Database, which refers to the Storage images. I started using it with the default security rule there, which was read and write free for everyone. So I started getting messages, from Firebase, saying that the rules were not safe. I then changed these rules to the following:

rules_version = '2';
service cloud.firestore {
   match /databases/{database}/documents {
    match /{document=**} {
      allow read;
    }
  }
}

I did the same for Storage. I only allow reading.

rules_version = '2';
service firebase.storage {
  match /b/{bucket}/o {
    match /{allPaths=**} {
      allow read;
    }
  }
}

Question: What is the rule to allow read-only, for any user, without creating users? Is this correct? Why do I get the message that the rules are not safe?

Thanks!