mis or poorly configured, yes. "sa" and no password on MSSQL, with direct connection to public internet - saw those for years. PostgreSQL/MySQL configured to

mis or poorly configured, yes. "sa" and no password on MSSQL, with direct connection to public internet - saw those for years. PostgreSQL/MySQL configured to only listen to localhost connections, and properly escaped/prepared queries running to them, with "minimally needed security access" credentials - haven't seen many problems with those (that were the fault of the database).