As nobody seems to do this, there must be a security risk I'm overlooking.

Human error, granting the wrong authorization to a client on the database level, could have drastic consequences.

Why can't we provide public SQL access to our customers? What could possibly go wrong?

You are creating unnecessary inconvenience for your customer's system :

• In order to write the proper sql queries against your database, your customer has to understand your database schema, or does he need just a part of it ?
  
• Your customer's code will be tightly coupled with your database, any change on the schema need to be reflected on the customer's code.

That's why, since the year 1, we tend to write applications and API endpoints to abstract the structures of databases.

As nobody seems to do this, there must be a security risk I'm overlooking.

Human error, granting the wrong authorization to a client on the database level, could have drastic consequences.

Why can't we provide public SQL access to our customers? What could possibly go wrong?

You are creating unnecessary inconvenience for your customer's system :

• In order to write the proper sql queries against your database, your customer has to understand your database schema, or does he need just a part of it ?
  
• Your customer's code will be tightly coupled with your database, any change on the schema need to be reflected on the customer's code.

That's why, since year 1, we tend to write applications and API endpoints to abstract the structures of databases.