As an interesting thought experiment, if you do something like this and give your end users a full sql connection almost by definition you can't have a sql injection vulnerability, the database itself limits what access the clients have.

Now as to if this is actually a good idea and the database internal security is robust enough to handle full access, Well I have my doubts, It is a complicated poorly tested interface and results as disclosed by the article in question are probably not surprising.

I do run a toy application, where the experiment was to see if I could push all authentication and access control into the database, It is actually sort of neat not needing an auth layer in the application, but attacks like this were half expected.

see also: the schemaverse. A multiplayer space game where the game engine is postgres. https://github.com/Abstrct/Schemaverse