Solved. My GCP user, the one logged in Firebase CLI with firebase login, was missing the setIamPolicy. Adding the policy to it and redeploying solved.
firebase login