I am interested in learning about use-cases for when an SQL server may be exposed to the internet, with or without some type of authentication in front of it. Are there legitimate reasons for this?
No, however, I do know that a big national company does this because the customers need to upload data directly. IMHO they should use an API instead, so no, I don't see any reason to do it. I wouldn't do it, it's a major security risk.