>I have heard that oracle and SQL server7 onwards have application specific rights. These can be more helpful for internet.<

This may be so to the extent that I can configure a Role and use that Role to convey specific rights to data. However, I can create a fictitious user on NT and grant rights consistent with a specific app, and have the app impersonate that user. I'm thinking here of an COM object that is only able to get at files it needs.
I think what has been pointed out here is that a true database backend allows for much greater granularity and control than DBF files in regards to security. My point was that we have some control through network security to prohibit viewing of sensitive data.