The main reason to prefer a RESTful API over direct SQL access is that it provides a static interface to a changing implementation - the API doesn't change if some of the data ends up being accessed through the file system or a messaging queue. Similarly, when you inevitably have to upgrade the database to a version with breaking changes, none of the clients have to change.
Another advantage is the simple query/response format. Compare five minutes to learn the basics of JSON to the days or weeks of writing a database client.
Access control is another big issue with databases. It's not just about who has access to what. How do you write complex rate limiting in a database? And how do you express complex application specific access controls such as who is allowed to send a personal message to whom? I'm sure it's possible to express these in a database, it's just that they can be much easier to express in languages geared towards general purpose programming.