Everything has vulnerabilities but a separate rest API lets you lock down far more access points especially if you further lock down the database itself. I like to fire up dockerized Django API frameworks when I need a secure, scalable rest in a hurry.