Important addition: physical reality has only one channel. Any control/data separation is an abstraction, a perspective of people describing a system; to enforce it in any form, you have to design it into a system - creating an abstraction layer. Done right, the separation will hold above this layer, but it still doesn't exist below it - and you also pay a price for it, as such abstraction layer is constraining the system, making it less general.

SQL injection is a great example. It's impossible as long as you operate in terms of abstraction that is SQL grammar. This can be enforced by tools like query builder APIs. The problem exists if you operate on the layer below, gluing strings together that something else will then interpret as SQL langauge. Same is the case for all other classical injection vulnerabilities.

But a simpler example will serve, too. Take `const`. In most programming languages, a `const` variable cannot have its value changed after first definition/assignment. But that only holds as long as you play by restricted rules. There's nothing in the universe that prevents someone with direct memory access to overwrite the actual bits storing the seemingly `const` value. In fact, with direct write access to memory, all digital separations and guarantees fly out of the window. And, whatever's left, it all goes away if you can control arbitrary voltages in the hardware. And so on.