I'd go further and say it's easier to teach prepared queries than string building (or at least equally difficult). That might not be true for other security is

I'd go further and say it's easier to teach prepared queries than string building (or at least equally difficult). That might not be true for other security issues but I think tutorial writers should be fine saying "here is a bit of magic that fixes a problem called csrf. We won't cover that in this course but leave this in here"