gorm (or any other ORM for that matter) is no silver bullet and just introduces unwanted complexity in the code.

Now, instead of being able to quickly see a query in one place what commonly happen is people breaking down all things and creating "helper" functions in strange ways to select, limit, order, and any other stuff, and ending up with something so complex you waste a lot of time to understand and only the original writer knows where to find anything. For me, this adds way more issues than any security concerns you might have related to learning SQL properly, too – and if you are using an ORM chances are you already know how SQL works anyways (and you can use static analysis tools to reduce the errors, plus the reduced cognitive load in using vanilla SQL).

We use it on all our projects though it really needs improved/additional m:n handling.

I'm familiar with gorm, but haven't seen it at any of our clients.