I've found many cases of this happening to others, but in all cases, as far as I can tell, it's been because the user is doing something unusual/custom.
In my case I have a very simple setup. Just a single "shopping" table in my public schema. The only thing I can think that might be wrong is the RLS policy I set on the table.
Since I wanted only authenticated users to use my app, but all authenticated users should have access to everything in the "shopping" table, I made a policy like this: