It is possible that they server is not given access to these functions, so they didn't need to be checked for, in the input.

This presents its own problems, if for some reason in the future they need to add one of these missing functions to the servers access, and don't recognise that they need to add the check as well.

But anyway, it is great to see the boss' nephew getting some work.

Indeed! And "alter table", "create view", etc... I'm glad I didn't joint that credit union when I considered it a few years ago.