In iOS apps the GoogleService-Info.plist is bundled in the ipa which means it can be accessed and extracted by anyone.

This makes me think that if someone would „steal“ this plist, they could go ahead, create a new app with the same bundle identifier (which is also a property in the plist) and flood your Crashlytics with random crashes or send random events to your Analytics.

In fact, this is what I just did with my own app. I created another Xcode project, did the same Firebase setup, copied the plist, used a completely different developer account, used the same bundle identifier (which AFAIK only works when deploying on a simulator) and made the app crash a couple of times.

It showed up in my Crashlytics page.

What am I missing here? App Check is not available for Crashlytics, so it cannot verify that it is a genuine app.

I‘d say the potential harm would be that an attacker could render your Crashlytics useless, by just flooding it with crashes and you would not be able to distinguish those crashes from your own. Same with Analytics.