Good question! not OP but one of the projects here provides a full PG api if you are self-hosting. Presumably the plan is to provide a similar but secure API for supabase hosted instances in future?
Yes, you're right. Eventually we will be adding migrations and a better local dev experience. For now you can use any tool you'd usually use with postgre - dbmate, seqlize etc
https://github.com/supabase/pg-api