And that they're leaving database servers globally accessible.

I do understand the need for network access but I'd never rely on the authentication frameworks (of any database server) to handle this. Limited network access or a front-end API (itself with limited access). Never expose your data source if you don't have to.