If that database server is a VM (cloud host or on-prem), the host will likely decide to have mitigations on. If the database server gives shell to DBAs or such

If that database server is a VM (cloud host or on-prem), the host will likely decide to have mitigations on. If the database server gives shell to DBAs or such who don't get root, perhaps yes. If the owners wish to restrict the attack surface of most of the non-database software running on a current day fat linux distro, perhaps yes. No mitigations means buffer overflow in any network-exposed code (DHCP client, DNS resolver, SSH server, Prometheus metrics exporter, ...) could lead to a ransomware attack on the database etc.