In addition to Sander's answer, I would add that at certain levels of PCI compliance this is a requirement:
Separate Web and Database Servers CHD is stored en mass in the
database, making it a high-value target to an attacker. Separate
database server means that access can be strictly controlled (limited
exposure). Required by Section 1 of the PCI DSS.
By separating web and database duties you're limiting your exposure. Typically your db is in a private segment of your network, and inaccessible publicly.
A static VPN connection is also suggested, in PCI, between your web/db and intrusion detection is strongly suggested on your networking equipment. In the event of a compromise the db will be isolated and the VPN connection terminated such that, even though your application and your encryption key are now compromised, access to the data store has been locked down and is inaccessible.
High Availability / Disaster Recovery:
Sander's on point here. Go vote him up. I would add that in the event of even a small maintenance task like taking a filesystem backup or a database dump your db will, at best, be limited to reads-only for some time. In extreme cases I've seen lock wait timeouts and process queues fill up that all available connections are queued or dropped. The site "goes down", effectively.
You can mitigate this by separating your db and scheduling your web server to place the site into maintenance mode during these backup windows without any consequence to the filesystem of the web server.