SQL injection bugs are not rookie mistakes, it’s prevalent in many current and future applications. Look into Vtech sql injection hack, a large company with lots of resources had similar bug.
Look at previous hacks, solar winds hack, Sony hack, were all preventable common hacks.
The reason it’s so prevalent is because it’s not a rookie issue and very difficult to fix properly, without impacting significant changes.
That’s why OWASP has it as huge part of security analysis and resolution.
This class of sql injection issues can be eliminated by simply enforcing that all queries are string literals.
Neither of these claims is true. Placeholders have been the recommended way to do this since the 1990s (I remember having this same talk with Perl & PHP 3 newbies) and one of the points of using a framework like Rails is that these are much easier to avoid if you use an ORM. The problem in this case is that they found a problem they (probably incorrectly) believed couldn’t be expressed in the ORM _and_ ignored the placeholder support _and_ didn’t validate their inputs. None of those require advanced experience to fix and at least the latter two are trivial to implement.
SQL injection bugs of this fairly trivial type are. This is literally what web tutorials were pleading with PHP developers not to do 20 years ago, and they weren't new then.
The whole situation is similar to having a construction scaffolding without safety railings, and calling someone falling off it a rookie mistake.
Large companies are even more likely to run into this sort of issue.
It's still a rookie mistake. Any given well established company will contain a large number of 'rookies'. It's up to the company and everyone involved to make sure these are caught before going into production.