Zero reason to have database servers with an internet connection. These days you can ship in an entire environment with containers into borderline air gapped environments.
It's better to build every server for public exposure from day 1 and treat all connections as potentially hostile, even if they're coming from the internal network.
Re: "You will sooner or later..." it's super easy to test for stuff like this with sentinel - I use this and scan dev / stage in my CI pipelines with rapid7 which will SCREAM about stuff like no DB password.
I would definitely say it's more effective to test your existing layers before adding more layers, and I think the "defence in depth" concept leads people astray there. Having multiple porous layers works on a battlefield where attacks are costly; it doesn't work on the internet where if one attack gets through an outer layer then all the other attacks can immediately get through the same way and start hitting the inner layer.