A read-only backup role is not one grant

-- before: assumed to read everything
grant pg_read_all_data to backup_reader;

-- after: also cover what that role doesn't
-- run once per large-object owner (only the owner can grant)
-- ...grant select on large object <oid> to backup_reader;
alter table app.orders force row level security;  -- if the owner must obey policies
-- pg_dump ... --password --schema=public --large-objects