putting the DB on the same instance and allowing public traffic to reach it is ALWAYS a bad idea.

It's also a good question why did they use a $250 instance and if they couldn't implement it with lambdas considering the owner uses it only a few times per day.

I agree that availability & resiliency are not necessarily important for this customer, but it's a good question how long does it take to rebuild the instance if it gets accidentally deleted. Recovery time could be critical (but also it could be that it's tolerable to be down for a few days!).

These are all questions that the implementing team should have discussed with the owner before designing the solution!