Use custom claims and enforce it with security rules.
Once a user has paid, or unlocks premium features in whatever way you see fit, then that user can get a custom claim associated with the users account in firebase. This can be checked for in frontend as well in backend.
More details and great examples at:
https://firebase.google.com/docs/auth/admin/custom-claims
与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…