DB stored procedures: how do they help increase security in web systems?
The theory behind using stored procedures for increased security is that you don't give DML access directly to users.  The idea is that users never get anything other than execute permissions on the procedures.  There's also a slightly less paranoid version of this approach where all writes are by stored procs, but table/view reads can be done by users.

The reasoning goes that if users only have execute permissions on stored procs and no direct DML on tables or views, then they can't manipulate data in any unpredicable ways.

To take an example, let's say you've got a bank account system and the only way to make a funds transfer is through a stored proc, you can have this proc audit log details about when it happened, where the money went and so forth.  If you allowed direct DML access to the base tables then a compromised account could be used to take money without leaving an audit trail.

You are right that a compromised account is still a big security hole - big enough to drive a truck through.  If all the compromised account's access is restricted to stored proc execution however then at least the hole will only fit a smaller truck.