A web app has a connection to a database that can be limited to its exact permission needs, input can be sanitized, database execution can be limited to exactly

A web app has a connection to a database that can be limited to its exact permission needs, input can be sanitized, database execution can be limited to exactly what the interface has available. Apps can also use connection pools to manage limits of the database. If the database itself is publicly exposed, even if a read only connection with access to an empty table is provided an attacker could simply max out the connection pool to kill your application. If a vulnerability was published or a password with more access was available they can not only access all of your data but they can corrupt it and/or delete it. SQL injection has been pretty trivial to stop for a couple of decades now.