“even really strong development teams”

One would think a single really strong developer, let alone a team, would look for interpolation in strings fed to RDBMS?