I believe the alternative is a VPN, secure tunnel, authenticated proxy, or similar. Those also have accidental failure modes that would permit access to the DB regardless of which subnet it's in. I'd consider each of those as a second factor, in addition to the DB password.