It's not really any different than using pgbouncer or something similar. All it buys you is not having to use the PG protocol on the client.

There is no extra security here though. One could even argue you lose security here, since now you have to rely on the app to not get tokens confused, since they hold and use the tokens on behalf of the user. A single bad CVE in the app and one can become any user the app currently knows about.