I do think there would be serious security implications in exposing read-only access to even a limited number of tables via arbitrary queries from clients. DoS would be trivial and unexpected data leaks easy. Having to explicitly expose parts of your data only as you intend is a great security precaution (and good use of abstraction).

But I don't think the intended use is to have client browsers hit DBSlayer directly. My understanding is that you send SQL from your app layer via HTTP to DBSlayer then it hits a DB and returns JSON.