Usually they do not leave the database server directly accessible on the Internet. Usually there is a service (service / daemon), even if it is engaged only in retransmitting requests from clients to the DBMS. This is a safety issue, and if in your situation it is different, then it makes sense to think about it.
The list of those who are online (and any other information) can be obtained not only by means of a periodic survey of the server part, but also by means of a subscription to the notification. Of course, the latter must be supported by the server. The DBMS is usually not provided with such a mechanism, but it may be the same server frontend mentioned in the first paragraph of the real answer. In this case, the client can subscribe to a so-called subscription to notifications about a certain event, and already the server will send information about changes upon their occurrence.
Of course, the DBMS will not warn about the changes and the server part itself, but the fact that someone has logged in or logged out - these events anyway will go in the form of requests from clients to the server, which means the database here is not at all fundamentally necessary element. The maximum that is usually given to it is to save - these are long-term keys describing the session, while checking the fact of online or lack of connection with clients the server part can fully work out for itself, simply by querying the registered sockets.