Necessity of a DB-replication as extra security layer
If the application (publicly accessible) is attacked / DDoS´d, only the connected replica DB will be affected and the main DB can operate normally

That's the reason.
If the Application running against the replica database is publicly accessible, then it can be attacked.  If it is attacked then, as you say, the replica database will bear the brunt of that attack.  The remainder of the company, running against the primary database, can continue operating [largely] as normal.
As long as the web application is of secondary importance to your company, then this arrangement makes sense.  If you work for eBay or Amazon?  Not so much!
That's not to say that the primary database is completely unaffected by this!  The replication processes, trying to write to the over-loaded replica, may be impacted too, which may feed back into poorer performance on the primary or, depending on how the replication system works, potential disk space problems with logs not being shipped and cleared down as quickly as they should be.