Here's one that's meaningful to me. We have a single database with five different applications that access it, each of them managed by a separate team. By enforcing access constraints in the database we guarantee the access constraints will be applied in all cases. It is difficult to ensure that in application code managed by separate teams.
(Just to be clear: I don't think your advice is poor, I just wanted to give an example of a case where it isn't universally applicable.)