Does a wildcard have to be used for the document segment in a matching path of a Firestore collection group security rule?

Question

db.collectionGroup(\'private\')
  .where(\'members\', \'array-contains\', userId)
  .get()
  .then(...)

This