Yeah, but you’re just shifting the location you expect bugs. Using parametrized queries at SQL level doesn’t guarantee you don’t have bugs of this kind at the database layer.

Obviously they’ve been proven for tens of years now, so it’s extremely unlikely, but conceptually it isn’t different.