This question already has an answer here:
- Security: Modern database management systems support SSL connections (e.g. PostgreSQL). We can securely connect to a DBMS. There is no difference between securely connecting to a database and securely connecting to an application server.
- Authorization: We can define stored procedures in modern database management systems. We can define the functional interface of users by using stored procedures and functions. We can authorize users to use only selected ones of those procedures. We can restrict them from using any of create, drop, select, insert, etc. statements.
- Efficient bandwidth usage: Modern database management systems support data compression. We can get much more compressed raw data from a database server for unit bandwidth and decompress and "HTMLize" that raw data on the client by using the client's computing resources (distributed computing is a plus).
So I think there is nothing wrong with using a two-tier system on current DBMS and browser technologies. Any objections?