Yes, it feels dated since JDBC brought prepared statements into the mainstream literally decades ago. Though I have seen this still happening from marketing hiring external marketing agencies to write some small apps for them, e.g. a web game for grabbing email addresses. Hopefully they don't have access to your main database (though I have seen this in startups too, because fast,fast,fast).