“even really strong development teams”
One would think a single really strong developer, let alone a team, would look for interpolation in strings fed to RDBMS?
And yet here we are
Everybody knew somebody should do it, but nobody did it.
Classic.