The machine that runs the agents holds no secrets

Why the half of the server that executes model-written code is kept away from the database, and what the separation cost to build.