In some cases, people will defer to database level security restrictions.  It really depends on how much application logic is in the database.  Some applications are designed with as much logic as possible in the DB, including each user being a db user with credentialed access.  Others will treat the DB as dumb storage with all access through a programatic API... with thin API shims over DBMS, the db security is paramount.