Following the breach of avast:forum.avast.com they decided to host the database email@example.com. My question is, what is the point of hosting the database externally since when you get remote code execution on forum.avast.com (which has access to the database hosted on id.avast.com) you can then steal the database anyway? Is it so no data is lost/destroyed?
They're using id.avast.com as an authentication provider, not just an external database. So RCE doesn't get you access to it (assuming it's a different host machine), SQLi certainly doesn't, and since it's on a different domain (origin), neither does XSS. They've now significantly isolated their password hashes from the forum software.
Using an authentication provider is very different than just moving the database to another host. (And also consider there are many threats other than RCE.)