Definitely taking all the security measures I can, but you're right, things can go wrong. I do encourage (and would like to enforce) that db credentials provided should have very limited read access to only the tables/columns that the user wants to query.
Having said that, it's totally understandable that some orgs won't want do open up their db. The idea with going open source would be that they can host the platform in their VPC so that their data is never leaving the premises.
Not against having an SDK or API at all, but I would need to think about would work because the whole syncing issue is one that I'm focused on addressing here.