Exactly. Why not using a host witout connection to internet to host the database ? One could use a simple serial or usb link to exchange information with the host with a specific protocol. There is no way someone could hack ino the database.
A "simple" transport medium won't prevent security issues itself (you can run PPP over RS-232), but it will force you to define a fairly minimal API, which is possible with HTTP too.
Notice how all these leaks were not because of HTTP server security issues or the like, but because the critical parts of the application were not isolated.
No need to force obscure interfaces, just add an extra NIC and connect the critical part over Ethernet.
A different strategy could be to use a set of distributed server hosted at different hosting providers and use shared secrets. This would require that k hosts over n are compromised for the full system to be compromised.
Such system is more difficult to design so that it is as secure as the shared secret. But the benefit is that it would be distributed and thus avoid the single point of failure of a server behind a dedicated link and in a cage.
