It doesn't help that the common advice to securing a database application is "don't, it's too hard to secure databases, just write another application to talk to the database application, and secure that."

A database is just another application. SQL is just another Turing-complete programming language.