Placing the databases in private subnets ensures they are not directly accessible from the internet. Private subnets are not routeable from the internet, which provides an additional layer of security. Machines in a private subnet typically communicate with the internet through a NAT instance or a gateway in a public subnet, serving as a buffer. A VPN alone does not provide the segregation between the databases and web servers. An Internet Gateway directly exposes the subnet to the internet, which is not desirable for databases. A NACL (Network Access Control List) itself does not determine subnet's direct exposure to the internet and is more for fine-grained inbound and outbound traffic control.