Earlier quoted context omitted.
If you connect to your database over TLS (maybe with an extra client certificate or something), I don't see much of a problem.
As far as protocol is concerned, if you're using TLS, a client certificate, and a strong password, sure, opening your database servers to world accessible should be fine. The problem is that it's possible, and very likely, there are exploits in the wild for your database server -- that are known but you failed to update for a day, or are 0 day exploits -- which are exploitable without having an authenticated account.…
https://devcenter.heroku.com/articles/connecting-to-heroku-p...