still having trouble parsing that (not trying to be dumb here, really!) in java, my java app might talk to a connection pool, which then talks the the database

still having trouble parsing that (not trying to be dumb here, really!) in java, my java app might talk to a connection pool, which then talks the the database. that connection pool could, I'd guess, be in a separate 'application server', no? my 'database and app server separation' thing - never quite got a straight answer on 'why', other than 'security'. except... adding more systems, with more logins, more access rules, more stuff to update/patch/test leads to... more potential for security failure (in my experience).