I came here to mention this, too. It's been shown from numerous leaks that defense in depth is a much more effective approach than simply relying on network sec

I came here to mention this, too. It's been shown from numerous leaks that defense in depth is a much more effective approach than simply relying on network security. You mention that query response data can be sniffed by an attacker in case networks are compromised. The much worse scenario is that the passwords themselves can be intercepted, giving attackers full access.