I'd argue that even then, they are less hardened against network-layer exploits than your average webserver. Network security is bread & butter for a webserver, not for your enterprise DB running in safe intranets with only cursory penetration testing.

I agree, though if you hardcode username and password into your application there's no need for fancy exploits.