I would not label it bad practice. Honestly, I'm not sure if there is a simple rule to decide what is good or bad. Using an ORM is not necessarily mixing in DB interactions.

Here is an example from the Django documentation [0]:

        selected_choice.votes += 1
        selected_choice.save()

The offender in my eyes is the save() method call. The first line is business logic, but the second line has nothing to do with business logic. It might be slightly better to hide the database interaction in the object itself, create a special method, and change the two lines into:

        selected_choice.increaseVotes(1)

As a counter argument, I dislike code which hides database accesses, because that easily leads to code which does way to many of them and thus is unnecessarily slow.

[0] https://docs.djangoproject.com/en/2.0/intro/tutorial04/