The intended use doesn't matter. That's a huge potential exploit. I would never deploy an application based on a framework where database access from the browser is baked in.

Database access from the browser is not baked in. This is a misunderstanding. Meteor has a browser cache that mimics a subset of Mongo commands, and auto-syncs with the back-end based on security rules you define.

Thanks for the clarity. That will teach about commenting during the morning commute.