That's true, but there are usually multiple ways to compromise protected networks. You still need to protect the database against attacks that don't go through the app server.