Your DB systems that use Object Storage for backup and patching no longer need to be in a public subnet with access to an internet gateway. Instead, they can be in a private subnet with access to a service gateway.
For more information, see Service gateway with private access to Object Storage from a VCN.