The term “exposed” is a bit misleading in this context.
It's perfectly legitimate to have a database system which is reachable from the Internet. The only other options are to put the database system and the services which use the system (e. g. web applications) onto the same machine or into a private network. Depending on the infrastructure of the hosting service, this may not be possible or desirable.
When a database system is running on a public IP address, that doesn't mean anybody can just connect to it and access any data they want. A properly configured database system requires authentication, be it through a password or a stronger method like client certificates. Without the credentials, connection attempts will be immediately rejected. But even if you have the credentials for some account, you will only be able to access the data of that account, because common database systems also check whether a particular user is authorized to read, change or add specific data.
I don't know the specifics for Heroku or Railway, but given that these are professional services, I'd be very surprised if they kept their customers' data on a publicly accessible database server without any authentication and authorization.