Database by itself is easy, but the rest of a public-facing exchange would be a lot of security to get right. I've seen contracts for blockchain exchanges, they're not that complicated, and the footguns have been figured out already. Once they set that up, they don't have to host anything publicly, or very little. The orders are typically matched off-chain, but their backend just talks to the chain, not end users.