This is an optimistic counterpoint.

However realistically nearly all persistence services such as MySQL, Postgres, MongoDB, Memcache, ElasticSearch, etc either have been insufficiently hardened as a public service or flat out are not intended to be used on a public port and depend on the network for security.

There is not currently an option to connect an RDS database instance to a Lambda function without opening said database instance up to the public. It's a problem.

You are correct that SSH tunneling could be used to provide security but such usage is not yet a standard approach.