I want to know why calling a database from the front end is considered a bad practice for security.
It is really so bad as to justify building an application layer with all its drawbacks: costs, performance, development time?
I'm not sure what exactly you mean. Separation in to layers like application and business logic and data access is not so much about security as it is about maintainability. It's done to make the code useable and be able to do things like change the database you use without having to fully rewrite the application.
It does also make security easier as you can secure the DAL to ensure that SQL calls can't be abused, but the same thing can still be done with a little more effort even if your code is completely flat.
So your initial premise that it is a bad security practice isn't exactly correct, it's just a bad programming practice in general. The fact that it makes security more difficult to implement well is just a secondary effect of the bad general design.
A database connection will let the user do pretty much anything he likes to the database, provided he has the access rights. Open a connection straight to the Internet, and the only thing keeping any user from admin account access is the secrecy of the password of the admin account. For the most part, you won't see a database system built with this sort of access in mind, so you won't see protections on the database itself that are crafted for this usage.
Given admin access, and connectivity, a hacker can:
So.. the return question is - what's the purpose of the database, and how much does it's integrity matter? If this is a test database for a student project, you may care more about the machine itself than the database. But in most applications, the information in the database and it's validity, availability and reliability are the heart of the system. Loose that, or loose your trust in it and in many cases, you no longer have a functioning business.
Speaking as a web developer, though - the biggest driver to having a web app is still not security - it's functionality. People don't tend to think in SQL - so you need an interface that lets a less technical user view and manipulate data in a way that the user can comprehend. Once you admit, even in one case, that you need a web server or app server to render the data into a user-readable page - then you've bitten off the need for the bigger costs of staging the application server. And once you've invested time and energy in developing forms or other data input mechanisms that the average user can use, you've invested enough in the site overall, that doing it correctly - with solid security practices is a wise investment not only to protect your data, but to protect the value of the investment in building the application.
I'm a little unclear on what you mean by "front end" but if you are talking about somehow firing database commands directly from the client side of a web application this would be very bad.
In addition to that, it is a bad idea to have your database server accessible from the internet. Typically you want to have a web server that is accessible from the internet and then your database server would be available to the web server.