This doesn't make any sense. There's no scenario that keeping the DB limited to being accessed by Heroku dynos would make it less secure than leaving it open to

This doesn't make any sense. There's no scenario that keeping the DB limited to being accessed by Heroku dynos would make it less secure than leaving it open to the internet AND all of the other ways you can access it currently. Beyond that, if you leave it accessible via the internet, you are banking hard on postgres not having a zero-day that lets someone get through without brute-forcing the password (or heroku being slow to update your software).