I appreciate your efforts to put down missing functionality. Products evolve over time, cant expect everything in first cut and compare it with product which is staying for quite sometime
Our DB servers don’t have any ports listening on the internet, not even SSH.
TLS can be enforced for DB connections (both pg and mssql support this), but that’s still prone to credential stuffing and the client machine isn’t usually authenticated. Lots of regulations generally require some extra security layer protecting connections to the DB.