Is using an api server like rest for my backend a secure way?

Nowadays I see websites are made using a sperate api backend server which provides the data from the database called a REST API server. When I was at school they taught me how to connect to apache using php to access the database!! I was thinking is this is safe (using api)?? Like if I have such an api which gives data from the database anyone can request a direct api call and steal that data. I know there is something called api token and private apis. But if somehow someone manages to break that then the my server will make all data public. Isnt the old method more safe because only my website has access to the database. I just want to know how exactly does this backend rest api works? I had done a project and my rest api can be accessed by anyone using my websites url.

Please someone explain the foundation of using such separate app for backend