The 3-tier architecture model is actually a "communication model", not a software model: the browser talks to a server that talks to the database. It's a popular model that emerged through things like PHP and dynamic pages. Programmers asked themselves, what are we doing? Oh this is it - Presentation / Logic / Database. That was then adopted as a "software architecture".
But why do you need custom code in between a web browser (presentation), and the database? It worked in the past before the web. Security was the original reason. But that was really a workaround. The real reason, is that databases don't "talk HTTP".
There's another way
So the security risks that come with 3-tier software architecture is custom code. The risks have certainly been mitigated, but there's no need to continue that struggle. With GraphQL you practically eliminate the security issues, and also save time and money.
Logic on the side
So where does Logic fit in then? see https://colossal.gitbook.io/microprocess/comparisons/compared-to-multitier (I am an author of this draft document)
With Google Firebase, you use the client library to write directly to a collection, then have a Cloud Function activate upon that change on the collection.
It's possible to do the same thing with SQL as well - see https://colossal.gitbook.io/microprocess/definition/data-web-gateway. You modify records on a table, a NOTIFY/LISTEN mechanism (with PostgreSQL) activates a standalone background process that then responds.
It's also possible with GraphQL, but you have the added "layer" of the GraphQL language - which some need. You can accomplish the same underlying NOTIFY/LISTEN mechanism for logic.
With Logic responding to the database, you have no need for a separate event or queuing system, infrastructure is simplified, and you end up with a system that is less coupled than a microservices system.