That's fallacious for two reasons: 1: you can set secure defaults at one place globally, but your code must be correct all the time to be free of SQLi 2: it's

That's fallacious for two reasons: 1: you can set secure defaults at one place globally, but your code must be correct all the time to be free of SQLi 2: it's usually not the same persons who configure the DB and who write the code. Security is an onion, not a coconut.