SQL query is a string. (that's where you don't pass the user input, not even quoted/escaped, as a policy) User input is passed "out of band", meaning not as a part of the query string. How exactly that happens depends on the RDBMS's particular client/server interface.
That's all that's enough to avoid SQL injections. And it has nothing to do with ORM.
Django's ORM will sanitize input when you pass it in as raw SQL.