Even when using straight JDBC I think a lot of developers still only use
one user account to access the DB, and do all security related features
in their Java code. Personally I have never used an application where
each user was a real database user with table level security etc.
Since business logic can be programmed in a service layer separate from
the UI, it could be exposed as a web service, remote EJB, CORBA, or
whichever technology you prefer. Database is just for storing and
loading data, and we don't make use of more advanced features. JPA lets
us hide the database even more since we never have to see or write SQL.
I guess that's OK for small systems, and larger more advanced systems
will perform much better when business logic is moved into stored
procedures, triggers, etc. I guess developers have found a balance
between putting some things in Java and other things in the database.