2 of 4 added 2801 characters in body

Use a real router/firewall, and put the web servers and database servers in separate VLANs, both of them outside the internal secure LAN, with firewall rules controlling access to the bare minimum required ports from the web servers to the database servers, and no access at all originating from the web servers to the secure LAN. The firewall would also prevent any direct access at all from the internet to the database servers, and tightly control any access from the database servers inward to the secure LAN (for authentication purposes or whatever).

That way, the attacker can't even get to the network with the database servers directly. If they get a beachhead on one of your web servers, they're still not on the same network with unrestricted access to attack your database server(s), and if you have any kind of log monitoring in place you should receive notifications about the breach of the web servers before the attackers have had much time to attack anything else.

And, even if they then manage to breach your database servers after some period of time through the one open port that the web server gets to use to communicate with the database, they've wasted all that time accomplishing relatively little, during which time you have been aware of their attack, instead of spending all of that time getting into your secure LAN. Because they can't even get into the LAN from the DMZ where the web servers live.

What's up with the unreasonable resistance to having more than one firewall? I don't understand why that is considered to be a big deal?

If I can be concerned enough about security issues to create guest and DMZ subnets at my home, to have a place to put "things" ("Internet of Things") without having them directly on my LAN, a concern worth billions can surely afford the mindshare and time to do the same thing with important web servers and database servers. I'm doing this at the office with a combination of a stack of several-thousand-dollar Procurve managed L2/L3 switches, a SonicWall UTM and a Ubiquiti EdgeMax router. At home, I have a $100 Ubiquiti EdgeRouter Lite, a $100 managed 8-port HP switch and one Ubiquiti Unifi AP that supports multiple VLANs. And I get the peace of mind of not worrying that my network-connected DVR, printer, BlyRay player, thermostat and whatever else, running who-knows-what buggy firmware with who-knows-what undiscovered exploits, can not reach out to my computer and personal files over the network.

It isn't super hard for security experts to configure this sort of thing, and it certainly doesn't have to involve separate physical hardware for each firewall.

Even the $100 EdgeRouter Lite can forward nearly 1 Gbps through the router, with support for multiple virtual interfaces and firewall rules between all of those interfaces.

One tiny box is really a whole basket full of firewalls.

So if you spend real money on a higher-end router, you'll get all those features and a few more with beefier routing performance.

Even something like the Ubiquiti EdgeRouter Pro 8 gives you 2 million packets per second for only $375, with 8 physical interfaces and VLAN subinterfaces on each of those if you need them. If you need higher performance than that, look to Brocade (Vyatta), Cisco, Juniper, etc. for bigger hardware. Or something like Dell/Sonicwall's SuperMassive series.

I'm not trying to peddle routers, just making the point that the bar isn't actually all that high to get the kind of security separation you should probably have here.