Personally, I see no reason why a backend server (like database, appserver, etc) should be open to the internet. They should be behind quite a few firewalls. Nobody should ever have to leave their MS SQL port open to the internet unless it is a very specific situation.