The previous code that used those functions probably did prevent a SQL injection as a side effect, as using them avoided making a direct SQL query at all. But

The previous code that used those functions probably did prevent a SQL injection as a side effect, as using them avoided making a direct SQL query at all. But you're of course correct that it's not the replacement of an ORM call with SQL that's the problem.