A database connection will let the user do pretty much anything he likes to the database, provided he has the access rights. Open a connection straight to the Internet, and the only thing keeping any user from admin account access is the secrecy of the password of the admin account. For the most part, you won't see a database system built with this sort of access in mind, so you won't see protections on the database itself that are crafted for this usage.
Given admin access, and connectivity, a hacker can:
- delete the database entirely
- rewrite the schema of the database
- resize the database, consuming more machine resources than you intended
- change the data in the database
So.. the return question is - what's the purpose of the database, and how much does it's integrity matter? If this is a test database for a student project, you may care more about the machine itself than the database. But in most applications, the information in the database and it's validity, availability and reliability are the heart of the system. Loose that, or loose your trust in it and in many cases, you no longer have a functioning business.
Speaking as a web developer, though - the biggest driver to having a web app is still not security - it's functionality. People don't tend to think in SQL - so you need an interface that lets a less technical user view and manipulate data in a way that the user can comprehend. Once you admit, even in one case, that you need a web server or app server to render the data into a user-readable page - then you've bitten off the need for the bigger costs of staging the application server. And once you've invested time and energy in developing forms or other data input mechanisms that the average user can use, you've invested enough in the site overall, that doing it correctly - with solid security practices is a wise investment not only to protect your data, but to protect the value of the investment in building the application.