In my experience this is pretty common for databases only to be accessed via local host. We had our office ip whitelisted, but now some database clients (datgrip, dbeaver…) can ssh tunnel to access. Plus phpmyadmin is still no uncommon..