The connection strings(url and api key) are still required to get access to your database tables,turning off the RLS for a given table means that anyone who is connected to your db can get access to those tables and modify their content,supabase will not apply any restriction as long as the user his connected to the database.