In this sort of world, how do you prevent users from making bad queries and hogging all the database resources or even crashing the database? How do you prevent users from wiping out data? (I get that you could back it up and restore it, but depending on the company, this could cause serious downtime and loss of revenue).

I think of this in two parts:

1) Computing is cheap, human time is not.

2) Competition in established industries is fierce (finance, real estate, education, construction, etc)

-- To the extent possible, I'd:

a) time out bad queries

b) add more hardware where feasible

-- For the "wiping out data" part, I think:

1) Mark things as "removed", delete when {GDPR,CCPA,etc} requires it

2) The UIs designed can/should have human processes in mind -- that is, things like multiple people involved (async) on what to do with a piece of data (flag it, mark it removed, send it for approval, etc) -- what a lot of companies are calling "workflows" and "workflow management platforms" these days.

3) Backup/restore should be used only as a last resort (DR and the like)

4) Versioning like Google Sheets of the UI is paramount and integration with CI/CD systems is crucial to having the cake (allowing people to create the tools they want) while also eating it too (making sure IT doesn't drive the above-mentioned dune buggy off a cliff in protest)

That's kind of how we design my web applications.

We store all the data in the database and the applications query the data/ process and return. We actually have multiple applications in various languages accessing the data (php, java, perl...).

Its genetic data so a lot of tables are shared across our applications. Gene symbol lookup for example).

When I started in this field I worked with Lotus Notes. Its actually a shared nosql database which users can create applications that query it as they see fit. I was clunky, but it could be effective in making custom team tools.