>Someone returns an ActiveRecord `User` object from a database method and now random other parts of your application are intricately linked to your database implementation.

Indeed. Its a rookie mistake but hey, you work with rookies all the time! Orms can be useful but they certainly allow for some dangerous patterns that are hard to notice if you're a young developer.