YES!
Having a firewall in place that restrict access to your database and/or internal services doesn’t guarantee your assets will be secured.
We usually consider any restriction integrated by a firewall to be a “Security by Obscurity” mechanism that doesn’t come close to a robust security mitigation approach.
Anyone who can use a USB drive in a local network, connect to Wifi in your building or access one of your online and public services could also escalate his privileges to gain access to sensitive data.