Let's say you have a remote client connect to a url to the database. You stream a download through there. You close the connection when you're finished.

No commands run.

No persistent access.

Lawyers are amazing.

Edit: Yes, based on the comment by dherls, this is how they're getting around it. Streaming replication is not commands run by the attackers (it's your own system doing the exfiltration!)