The website's functionality is secure and does not allow arbitrary queries to be run against the database.
However, let's say someone gains unauthorized access to the username and password of the MySQL database (i.e. those used in the database URI).
Not sure if this is what you're implying, but it's not enough that the website's functionality has to be secure - the whole server running the MySQL database has to be secure as well. Your website can be as watertight as it likes, but, to take the extreme case, if the backend MySQL database is running on a publically accessible IP, and listening to requests globally, that username and password will then allow you to connect to it and run all the arbitrary queries you like.
Bypassing the above, other aspects such as password reusability, and assuming everything is "completely" secured and locked down, then yes, those credentials aren't of any specific use. Like pretty much every strategy in this domain, keeping them secret is to add a layer of security should vulnerabilities ever be found that would make those credentials useful.
In practice, locking those credentials down should be pretty easy. So if an attacker has got their hands on them in the first place, the implication is that your setup is definitely not secure, and there's likely a whole host of other vulnerabilities yet to be unearthed.