This is true, but its an existing issue with our mongo security model anyways.  This is the reason in spaces behind the "Everyone Read" flag in our security model.  I believe it would be come a problem on spaces end long before it becomes a problem with firehose.
Also, I think the benefits of limited firehose-spaces interaction is so strong as to be worth it.