But since you can't guarantee that every programmer and contractor, including future ones, write proper SQL, it's nice to reduce the attack surface a bit.

hey man don't post my password here. Now I gotta change it again and I'm running out of good sql queries.

Unless I'm missing something here, lacking parametrization is not the issue here. The issue is that it's obvious they are saving the password in plaintext instead of hashing it, otherwise the password would never get close to an SQL query to allow injection.

Citi Student Loan website maxes out at 6 or 7 characters and is utter garbage on top of that. Worst case though, someone could pay my student loans for me I guess.

A finite blacklist? No, I don't think so. A regex blacklist? Yes; trivially if you can be radically overly cautious.