1. You need a query that can't be handled by your ORM, since in general ORMs can't expose all functions of a database. (This condition is also met if you have no ORM.)
2. You need a query that is going to have a varying number of parameters, so you need to manually assemble the query.
When that happens, there's a temptation in almost all systems to try to write the moral equivalent of:
sql_query = "WHERE condition = '" + param1 + "'
if something:
sql_query += " AND other_thing = '" + param2 + "' "
Programmers who are not really fluent yet and are still having to think about every line either don't think about, or are trying to avoid the complexity of,
sql_query = "WHERE condition = ?"
params.append(param1)
if something:
sql_query += " AND other_thing = ? "
params.append(param2)
There's also usually a library in the target language that is a pretty good reflection of SQL that avoids this problem (such as SQLAlchemy in Python), but I think that most people consider this "too complicated".