Understanding an application's logic

We have reviewed how publishing will work for our application's components, but should they all be published? The short answer is probably no. Imagine a three-layer application. We will have a middle layer for some kind of backend that will consume a database and should be accessed through a frontend. In a legacy data center, this layered application will probably run each service on a separate node. These nodes will run on different subnets to isolate accesses between them with firewalls. This architecture is quite common. Backend components will be in the middle, between the database and the frontend. The frontend should not access the database. In fact, the database should only be accessible from the backend component. Therefore, should we publish the database component service? The frontend component will access the backend, but do we have to publish the backend component? No, but the frontend should be able to access the backend service...