The issue I found with the raw SQL approach was receiving back flat results. I made PureORM[0] to do only and exactly that: map flat data to correctly nested business objects.
It is called "pure-orm" both because it is _purely_ an ORM (no query builder api), as well as because it returns _pure_ business objects (instead of db-aware objects).
That looks like a pretty cool project. I wonder how much work it would be to integrate with https://www.atdatabases.org/ to get the proper protection from SQL Injection.