This is a mistake that a lot of people make - treating database as an implementation detail. Relational model and relational calculus/algebra were invented for _sharing_ data (not storing). The relational model _is_ the interface. Access to data is abstracted away - swapping storage layer or introducing different indexes or even using foreign data wrappers is transparent to applications.
Security and access policies are defined not against API operations but against _data_ - because it is data that you want to protect regardless of what API is used to access it.
> To be clear, different services wouldn't operate on their own duplicated version of the same shared data, in their own database. They'd call a defined API to get that data from another service.
You mean synchronous calls? This actually leads to what industry calls "distributed spaghetti" and is the worst of both worlds.
> The whole point of this is to allow each service to define the interface for their data.
The point is that well defined relational database schema and SQL _is_ a very good interface for data. Wrapping it in JSON over HTTP is a step backwards.