Because SQL isn't properly composable. You can do simple stuff like parameters to avoid blatant injection attacks. But for any remotely complex branching logic,

Because SQL isn't properly composable. You can do simple stuff like parameters to avoid blatant injection attacks. But for any remotely complex branching logic, you're back to string concatenation. This is historically an area ripe for security flaws and bugs. Many devs rightfully seek out tools that provide a layer for composing logic with slightly more sanity. That said, if you're using a generic SQL abstraction layer, you're not really using Postgres per se. You're using a small subset of it. JSONB documents, full text search, powerful aggregates, materialized views, derived columns, geospatial data operations, time series analytics, statistical inference engines... so much power available with a few SQL statements. It is a shame to see most of it lost behind an ORM. I think the best we can do is use ORM-ish tools for the basic stuff but always have an escape hatch where you can (safely) drop down to raw SQL when necessary. We shouldn't be scared to use it, but it is a sharp weapon. Wield wisely.