Make sure you are accounting for the reads incurred by your security rules. If your rules themselves access documents, every read and write can incur additional reads. You could consider disabling your security rules and checking if then your counts match for quick confirmation.