Earlier quoted context omitted.
Not sure about SSL, but in the past customers of mine have copy-pasted full Heroku PG URLs to me and I was able to get in via `psql` immediately. So yes they're public but their addresses are basically impossible to guess.
Known as "Security through Obscurity" [0] [0] https://en.wikipedia.org/wiki/Security_through_obscurity
I still think it's a low-friction solution. But a secure one -- hardly.