Isn't that only true if "millions of businesses" choose to hang their PG port out on the Internet with "allow 0/0"? In the spirit of being constructive, https://www.shodan.io/search?query=postgresql shows 516,000 which is definitely not none but pretty far from millions and based on skimming the results pretty far from the businesses part, too

I would consider it a more useful lateral movement vector inside an existing org than anything else. Lots and lots of old postgress with weak acls inside networks.

I've had people tell me that they trust postres RLS as their security boundary and that it's fine to expose.