Marked as helpful by the asker
The editor runs as postgres and skips RLS. Your app runs as the user and every row goes through the policy. If the policy does a subquery per row (exists (select ... from profiles ...)), you get 2 seconds.
Fix: wrap the expensive part in a security definer function marked stable and call that in the policy, or add an index that matches the policy's filter: (user_id, created_at desc). Check with explain analyze while impersonating a user: Supabase's editor has a role switcher for exactly this.