There is a simple answer.

If your code is OK, then someone won't get access to either without breaking into somewhere that they shouldn't be. If the person has remote access to the database, they might not get anywhere else from there. If they have remote access to your webserver, then odds are high that they will shortly apply a rootkit, read your code and get at your database, etc.

So access to site root gives database access but not vice versa. Hence site root is more secure. (You have secured it, right?)