This may be a taboo opinion, but I would like to see every PaaS / Server provider implement something similar to this. Maybe don't delete databases, rather disable the public interface unless the owner of the server has double-opted in to making the DB public. Add it to the MSA / AUP so that there is no question as to why the host was removed from the network. At very least, scan your own networks and alert your customers if they have a DB exposed.