We are already using sqlite3, this is our rdbms. But in order to have a web API, it requires both sqlite3 and a webserver. So why adding the webserver overhead and security hole?
I think connecting via rpc is faster and more secure than connecting through nginx or anyother webserver. Isnt it?
If you're using sqlite3 then there is no background service, most of the load is when inserting new rows. As for security holes, I don't know. If you're allowing random node commands, albeit secured, then it might be argued that a wrapped https call is more secure as you get to control which commands can or can not be called and from which IP. But honestly, you could be right.