This is an optimistic counterpoint. However realistically nearly all persistence services such as MySQL, Postgres, MongoDB, Memcache, ElasticSearch, etc either

This is an optimistic counterpoint. However realistically nearly all persistence services such as MySQL, Postgres, MongoDB, Memcache, ElasticSearch, etc either have been insufficiently hardened as a public service or flat out are not intended to be used on a public port and depend on the network for security. There is not currently an option to connect an RDS database instance to a Lambda function without opening said database instance up to the public. It's a problem. You are correct that SSH tunneling could be used to provide security but such usage is not yet a standard approach.