firestore rules

Collection (user)

Field 👎

1. Name (string)

2. Uid( string)

3. Username (string)

And firestore rules

Match/user/{document}{

allow create : if true;

allow read : if request.auth.uid!=null;

allow write : if request.auth.uid == document;

allow delete: if false;}

If I use the user collection and firestore rules written above, can a user also change his username? Even if I didn't give him the button to change it.

(While we know that we do not allow changing the username in any app/website)