Yeah definitely not for public facing things of any capacity.

No matter your size unless you have a trivial amount of data, if you expose a full SQL query language you can be hit be a DOS attack pretty trivially.

This ignores that row level security is also not enough on its own to implement an even moderately capable level of access controls.