If you are happy to run everything via the backend it is probably ok (no worse than a typical app with an app level DB login that had access to all rows and tables)

With async programming there is little load in forwarding it on, and that’ll be fine at low scale most of us use.

Probably a great option for profile pics to avoid upgrading your postgres instance to a costly one.