I've been on teams building web applications for 14 years and not once have I seen someone simply rip out a query builder like this in production code and replace it with a non-parameterized string—let alone someone with 20+ years of experience.

Accidents and SQL injections happen, usually because of non-obvious query-building but this is a different level.