If your web app container can query the database, and your web app container is compromised, then yes the attacker could query the database. This is an issue independent of how you conveyed that access to the web app container.

If you want to limit the blast radius, you will need to find ways to limit what parts of the database the web app has access to.