There are several reasons you'd consider separating database and web server, and some will echo what's already been mentioned.
First, there's the potential performance issue. Generally, a database server loves memory. The more memory it can allocate to caching data, the less access it requires to read from disk. So there's a benefit to having memory. As a result, you can have a memory contention issue between the web server and the database server. With that said, there are plenty of cases where database servers are running on the same box as the web server, such as with MySQL or SQL Server Express or even full blown SQL Server with SQL Server 2005 Reporting Services.
Second, there's the case where your application may use some but not all of the data. This is especially true if internal systems touch the database, too. This isn't a likely scenario in a web hosting environment, which I'm guessing you're looking at based on your tags. But in that case, you can limit the access the web server has to the database to only what is needed. Yes, if the web server is compromised, they can get that access, but if it's a limited set of permissions, they can't get everything. Host it on the same web server and that's a totally different story.
Third is because you can gain some insight in whether or not your web server is compromised by looking at the network traffic between the web server and the database server using IDS/IPS. For instance, if we're talking SQL Server and xp_cmdshell gets sent to the database server, or sp_configure, that should tell the IDS/IPS something is up. And that gives you immediate warning that the web server is compromised.
Fourth is separation of duties. If you have folks responsible for deploying the web application, they probably need escalated rights to the web server to do so. What kind of rights depends on what you're doing, what OS, what web server, etc., but you get the idea. If those folks shouldn't have access to everything that's in the database server, and the updates to the database server are handled by a different set of people (like DBAs), they you can better protect the company by using different servers.