You can run multiple instances of a PHP application trivially, all talking to the same DB. That's one of PHP's strongest features.
For security, you're still tunneling through the front app, so there's little benefit to just forwarding requests.
The only reasons to split it up like that would be:
* There is non-trivial business logic in the model, and you want to connect to it from different *backend* languages. (Eg, you also have a Gatsby frontend.) Though it could easily be done in a single app.