Here's the root of my concern - safely and securely emitting SQL from an untrusted client is exponentially harder than running canned SQL queries from a trusted

Here's the root of my concern - safely and securely emitting SQL from an untrusted client is exponentially harder than running canned SQL queries from a trusted client. People forget (or don't care) about security or safety when it lets them move faster. "Move fast and break things," is a terrible security model.