I think you are talking about this example:

ResultSet rs = DB."SELECT * FROM Person p WHERE p.last_name = \{name}";

This when it becomes valid java will not allow an SQL injection attack. The name part would be properly passed as a parameter. Not a string concatenation. Per https://openjdk.org/jeps/430

If that was not the example you where thinking about, sorry :)

Otherwise yes don't build parameterized SQL out of strings !