Returning JSON to a client is relatively recent. The standard for web apps was to get data from the db and generate HTML on the server. A JSON layer would be a useless overhead.
Furthermore about everybody knows how to use an ORM. Not many people can write store procedures. Maybe the question is why is that so. I heard "I
know [language], I don't know SQL, so I write queries in [language] " so many times even from people I would have expected to have a much broader knowledge. (That also applies to networking technology, they know HTTP and nothing more.)
By the way the code doesn't address authentication and authorization, those go in the layer between the client and the database.
Returning JSON might be recent, but multi-tier apps where one tier talks to the data storage and applies business logic served up to a presentation tier dates back to long before the web. The rise of the web caused a lot of developers without any history with multi-tier applications to push "flatter" apps, that is true, but in terms of software development in general it's not new.
Even in terms of web dev, well over a decade ago I worked on a system where we had a middleware layer that consisted of a service that handled the business logic and talked to the database. This middleware layer took requests from a web frontend layer did most of the presentation and served up in various formats. The web frontend never talked directly to the databases. It gave us flexibility in how we sharded things, and in applying different extents of access control (e.g. we could put different frontend services in front of the middleware) as well as use it to enforce constraints that were impractical to express in the database. How important that is certainly depends on the database you use.
It wasn't a new thing then either - I took inspiration for that system from much older systems.
Furthermore about everybody knows how to use an ORM. Not many people can write store procedures. Maybe the question is why is that so. I heard "I know [language], I don't know SQL, so I write queries in [language] " so many times even from people I would have expected to have a much broader knowledge. (That also applies to networking technology, they know HTTP and nothing more.)
By the way the code doesn't address authentication and authorization, those go in the layer between the client and the database.