> It's going to be a whole lot easier for you to lock those two queries down, than securing an entire ORM.

If it's a competent ORM then it shouldn't even expose any way to not use prepared statements, for example.